Add exclude-paths option to dependabot.yml #12532

dnlfm · 2025-06-30T11:11:00Z

This PR adds the possibility of specifying exclude-paths in dependabot.yml.

It's a very old issue, and I decided to give a first stab: #4364

End-to-end tests may be required to validate the solution. Unit tests are in place.

Example of dependabot.yml with the new option:

version: 2
updates:
  - package-ecosystem: "npm_and_yarn"
    directory: "/"
    schedule:
      interval: "daily"
    exclude-paths:
      - "src/test/assets"
      - "vendor/**"
      - "src/*.rb"
      - "src/test/helper.rb"

randhircs · 2025-07-22T19:06:25Z

@dnlfm You may like to fix the specs which are failing.

dnlfm · 2025-07-22T20:32:50Z

@dnlfm You may like to fix the specs which are failing.

@randhircs I'm sorry but why did you force push, rewriting previous commits?

The failing spec is not related to the changes in this PR:

It seems this issue appeared after your commit. Force-pushes should be avoided, it may have modified something that it is hard to know what it is, as it may have rewritten the git tree. The Specs / ci was fine before this happened: https://github.com/dependabot/dependabot-core/actions/runs/16314785084/job/46077982547

randhircs · 2025-07-24T20:58:52Z

@dnlfm You may like to fix the specs which are failing.

@randhircs I'm sorry but why did you force push, rewriting previous commits?

The failing spec is not related to the changes in this PR:

It seems this issue appeared after your commit. Force-pushes should be avoided, it may have modified something that it is hard to know what it is, as it may have rewritten the git tree. The Specs / ci was fine before this happened: https://github.com/dependabot/dependabot-core/actions/runs/16314785084/job/46077982547

@dnlfm I had to rebase to proceed to check if all specs are passing. I am sure sorbet fix is something you can check from your end.

randhircs · 2025-07-24T20:59:50Z

@dnlfm Again now, I am checking by rebasing it to see if all specs are good. i feel that you may like to fix the sorbet issue.

dnlfm · 2025-07-25T07:30:40Z

@dnlfm Again now, I am checking by rebasing it to see if all specs are good. i feel that you may like to fix the sorbet issue.

Hi @randhircs,
I see "Sorbet" was added to this project but not really added to the files, i.e. not completely rolled out it seems. For example,

Checking updater/lib/dependabot/file_fetcher_command.rb for Sorbet typing...
No Sorbet typing found at the top of updater/lib/dependabot/file_fetcher_command.rb

The file file_fetcher_command.rb wasn't added by me, and it contains this error for Sorbet typing.
I would like you to check that, as it is something that was not added in this PR. Another PR that I saw where Sorbet is failing but didn't add the file is: #12589 where the file uv/lib/dependabot/uv/file_fetcher.rb originally didn't have the Sorbet typing, confirming that it is something in the project that wasn't rolled out well.

I would like to also ask you to remove the need of Sorbet typing in test files, as I added # typed: ignore, it is still requiring to use strict or strong, but again, it doesn't make sense to have it in test files.

I would prefer to not have to check these Sorbet issues by myself.

kbukum1 · 2025-07-28T21:20:12Z

@dnlfm Again now, I am checking by rebasing it to see if all specs are good. i feel that you may like to fix the sorbet issue.

Hi @randhircs, I see "Sorbet" was added to this project but not really added to the files, i.e. not completely rolled out it seems. For example,
Checking updater/lib/dependabot/file_fetcher_command.rb for Sorbet typing...
No Sorbet typing found at the top of updater/lib/dependabot/file_fetcher_command.rb
The file file_fetcher_command.rb wasn't added by me, and it contains this error for Sorbet typing. I would like you to check that, as it is something that was not added in this PR. Another PR that I saw where Sorbet is failing but didn't add the file is: #12589 where the file uv/lib/dependabot/uv/file_fetcher.rb originally didn't have the Sorbet typing, confirming that it is something in the project that wasn't rolled out well.

I would like to also ask you to remove the need of Sorbet typing in test files, as I added # typed: ignore, it is still requiring to use strict or strong, but again, it doesn't make sense to have it in test files.

I would prefer to not have to check these Sorbet issues by myself.

@dnlfm — We actually added full Sorbet type checks later on. However, files without proper Sorbet typings won’t be caught by the pipeline unless they’re modified. Once someone touches such a file, it becomes a requirement to fully type it, with the goal of gradually achieving complete Sorbet coverage.

If you're able to add the Sorbet typings here, that would be great. But if it feels like too much, @randhircs can help with that. Thanks again for your contribution!

@randhircs — You might be able to help here. Also, if you're planning to push additional commits, please avoid force-pushing, as we’d like to retain @dnlfm’s original commit.

dnlfm · 2025-07-29T10:09:35Z

@dnlfm Again now, I am checking by rebasing it to see if all specs are good. i feel that you may like to fix the sorbet issue.

Hi @randhircs, I see "Sorbet" was added to this project but not really added to the files, i.e. not completely rolled out it seems. For example,
Checking updater/lib/dependabot/file_fetcher_command.rb for Sorbet typing...
No Sorbet typing found at the top of updater/lib/dependabot/file_fetcher_command.rb
The file file_fetcher_command.rb wasn't added by me, and it contains this error for Sorbet typing. I would like you to check that, as it is something that was not added in this PR. Another PR that I saw where Sorbet is failing but didn't add the file is: #12589 where the file uv/lib/dependabot/uv/file_fetcher.rb originally didn't have the Sorbet typing, confirming that it is something in the project that wasn't rolled out well.
I would like to also ask you to remove the need of Sorbet typing in test files, as I added # typed: ignore, it is still requiring to use strict or strong, but again, it doesn't make sense to have it in test files.
I would prefer to not have to check these Sorbet issues by myself.
@dnlfm — We actually added full Sorbet type checks later on. However, files without proper Sorbet typings won’t be caught by the pipeline unless they’re modified. Once someone touches such a file, it becomes a requirement to fully type it, with the goal of gradually achieving complete Sorbet coverage.

If you're able to add the Sorbet typings here, that would be great. But if it feels like too much, @randhircs can help with that. Thanks again for your contribution!

@randhircs — You might be able to help here. Also, if you're planning to push additional commits, please avoid force-pushing, as we’d like to retain @dnlfm’s original commit.

Hi @kbukum1,

Thank you for your response.

it becomes a requirement to fully type it, with the goal of gradually achieving complete Sorbet coverage

I suspected that could be the case, but I would encourage a different approach: I would suggest that the team responsible for adding Sorbet could map the files that they need to go through and address each one of them, let's say, 40 files a week, prioritizing the ones in PRs that are already open. This way, PRs will have isolated changes, i.e. the PRs won't be touching something that is not meaningful to their changes, and thus making the code review process better.

Also, I would really appreciate if a code review is done on what I have done. I looked at my PR once again today, and I started wondering if what I have done will work for all kind of repositories or if there is something missing, for instance:

I added the exclusion logic to _fetch_repo_contents and _cloned_repo_contents, covering the flow for repo_contents in the Base implementation of a FileFetcher. However, I noticed that the FileFetcher implementations also implements their own fetch_files.
I'm not very familiar with the whole flow, but I assumed that they would use repo_contents at some point and I believe it may cover what we want to achieve with these changes. But maybe someone with more knowledge of the codebase or that is able to make a E2E test can tell me if there's any issue or something else missing, and then we can continue from there. Thanks in advance!

…as well

AbhishekBhaskar · 2025-08-05T18:56:11Z

@dnlfm, Also, we are planning on releasing this as a new feature. With regards to this, we would need to add a feature flag which when enabled, these changes would be in effect. I will be creating the feature flag shortly. Please let me know if you prefer adding the feature flag, which I can share with you, in the code or I can push those changes myself to the same PR. Thanks!

dnlfm · 2025-08-06T21:08:16Z

@dnlfm, Also, we are planning on releasing this as a new feature. With regards to this, we would need to add a feature flag which when enabled, these changes would be in effect. I will be creating the feature flag shortly. Please let me know if you prefer adding the feature flag, which I can share with you, in the code or I can push those changes myself to the same PR. Thanks!

Hi @AbhishekBhaskar, that's great and thank you for asking! Please feel free to push the changes directly to this PR.

dnlfm · 2025-08-06T21:15:57Z

@dnlfm We have provided fix for sorbet. You may like to resolve the conflict.

Thank you, @randhircs, fixed it.

mtrackeros · 2025-08-07T17:48:41Z

This PR adds the possibility of specifying exclude-paths in dependabot.yml.

It's a very old issue, and I decided to give a first stab: #4364

End-to-end tests may be required to validate the solution. Unit tests are in place.

Example of dependabot.yml with the new option:
version: 2
updates:
  - package-ecosystem: "npm_and_yarn"
    directory: "/"
    schedule:
      interval: "daily"
    exclude-paths:
      - "src/test/assets"
      - "vendor/**"
      - "src/*.rb"
      - "src/test/helper.rb"

…m:dnlfm/dependabot-core into dnlfm/exclude-directories-flag-issue-4364

randhircs

LGTM.

randhircs · 2025-08-04T21:53:29Z

common/lib/dependabot/file_fetchers/base.rb

        @linked_paths = T.let({}, T::Hash[T.untyped, T.untyped])
        @submodules = T.let([], T::Array[T.untyped])
        @options = options

        @files = T.let([], T::Array[DependencyFile])
      end

+      # rubocop:disable Style/TrivialAccessors


Please avoid using disabling rubocop.

@AbhishekBhaskar Could you try removing the RuboCop:disable

randhircs · 2025-08-11T21:49:10Z

common/lib/dependabot/file_fetchers/base.rb

@@ -453,14 +462,18 @@ def codecommit_client
        params(path: String, fetch_submodules: T::Boolean, raise_errors: T::Boolean)
          .returns(T::Array[OpenStruct])
      end
-      def _fetch_repo_contents(path, fetch_submodules: false,
-                               raise_errors: true)
+      def _fetch_repo_contents(path, fetch_submodules: false, raise_errors: true) # rubocop:disable Metrics/PerceivedComplexity


You may create new method and remove this # rubocop:disable.

randhircs · 2025-08-11T21:50:27Z

common/lib/dependabot/file_fetchers/base.rb

@@ -541,6 +554,66 @@ def _cloned_repo_contents(relative_path)
            size: 0 # NOTE: added for parity with github contents API
          )
        end
+        if Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files)


Try to split method to limit the method size.

common/lib/dependabot/file_fetchers/base.rb

dnlfm requested a review from a team as a code owner June 30, 2025 11:11

github-actions bot added L: java:gradle Maven packages via Gradle L: github:actions GitHub Actions labels Jun 30, 2025

dnlfm marked this pull request as draft June 30, 2025 11:37

dnlfm marked this pull request as ready for review July 1, 2025 01:03

markhallen added this to Dependabot Jul 1, 2025

markhallen moved this to Scoping in Dependabot Jul 1, 2025

markhallen moved this from Scoping to Ready in Dependabot Jul 2, 2025

markhallen moved this from Ready to Scoping in Dependabot Jul 2, 2025

dnlfm changed the title ~~Add exclude_directories option to dependabot.yml~~ Add exclude_paths option to dependabot.yml Jul 2, 2025

dnlfm mentioned this pull request Jul 2, 2025

Ignore manifests in specific subdirectories #4364

Open

jdm mentioned this pull request Jul 13, 2025

build(deps): bump requests from 2.32.3 to 2.32.4 in /tests/wpt/tests/tools/wptrunner servo/servo#38030

Closed

dnlfm changed the title ~~Add exclude_paths option to dependabot.yml~~ Add exclude-paths option to dependabot.yml Jul 16, 2025

randhircs force-pushed the dnlfm/exclude-directories-flag-issue-4364 branch from bf36625 to 696c6c6 Compare July 22, 2025 18:53

randhircs self-assigned this Jul 22, 2025

randhircs force-pushed the dnlfm/exclude-directories-flag-issue-4364 branch from 696c6c6 to 95d602e Compare July 24, 2025 20:59

dnlfm mentioned this pull request Jul 25, 2025

Track local dependencies from uv tool sources #12589

Merged

5 tasks

randhircs moved this from Scoping to In Progress in Dependabot Jul 29, 2025

dnlfm added 5 commits July 31, 2025 10:52

Add exclude_directories flag

a66dc0b

Require dependabot/config/file_fetcher in FileFetcherCommand

e3b8bb5

Add 'update_config' keyword to FileFetcher subclass initializers

fc11d89

Lint + reuse file_fetcher

006cfae

Change exclude_directories to exclude_paths so files can be excluded …

3348b16

…as well

Merge branch 'main' into dnlfm/exclude-directories-flag-issue-4364

1dbf1e8

dnlfm and others added 6 commits August 7, 2025 01:54

Fix create_file_fetcher - use config file correctly

5647165

Make sorbet typed false in test file

0659ed3

Modify github actions to skip Sorbet in spec files

bcd6a9f

Disable function size limit (temporary)

cf495c9

Remove trailing space

46b8473

Merge branch 'main' into dnlfm/exclude-directories-flag-issue-4364

3ee3314

AbhishekBhaskar added 13 commits August 8, 2025 10:17

Merge branch 'main' into dnlfm/exclude-directories-flag-issue-4364

3c3efaf

update filter-excluded function to cover edge cases

12ced8c

update filter-excluded function to cover edge cases

eea13a6

merge changes from main branch

10abf0b

Merge branch 'main' into dnlfm/exclude-directories-flag-issue-4364

220b11c

fix lint errors

7de578e

Merge branch 'dnlfm/exclude-directories-flag-issue-4364' of github.co…

c52611d

…m:dnlfm/dependabot-core into dnlfm/exclude-directories-flag-issue-4364

revert changes in file-fetcher-command

60cbb9c

revert dry-run code changes

feb7ed4

Merge branch 'main' into dnlfm/exclude-directories-flag-issue-4364

865af94

fix execute permissions for dry-run.rb

bc0d1e3

Merge branch 'dnlfm/exclude-directories-flag-issue-4364' of github.co…

a39fcab

…m:dnlfm/dependabot-core into dnlfm/exclude-directories-flag-issue-4364

change puts statements to logger

51ce356

randhircs approved these changes Aug 12, 2025

View reviewed changes

robaiken assigned AbhishekBhaskar and unassigned randhircs Aug 13, 2025

Merge branch 'main' into dnlfm/exclude-directories-flag-issue-4364

22cc480

AbhishekBhaskar merged commit 1b5d971 into dependabot:main Aug 13, 2025
126 of 127 checks passed

github-project-automation bot moved this from In Progress to Done in Dependabot Aug 13, 2025

Add exclude-paths option to dependabot.yml #12532

Add exclude-paths option to dependabot.yml #12532

Conversation

dnlfm commented Jun 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

randhircs commented Jul 22, 2025

Uh oh!

dnlfm commented Jul 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

randhircs commented Jul 24, 2025

Uh oh!

randhircs commented Jul 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dnlfm commented Jul 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kbukum1 commented Jul 28, 2025

Uh oh!

dnlfm commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

AbhishekBhaskar commented Aug 5, 2025

Uh oh!

dnlfm commented Aug 6, 2025

Uh oh!

dnlfm commented Aug 6, 2025

Uh oh!

mtrackeros commented Aug 7, 2025

Uh oh!

randhircs left a comment

Choose a reason for hiding this comment

Uh oh!

randhircs Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

randhircs Aug 11, 2025

Choose a reason for hiding this comment

Uh oh!

randhircs Aug 11, 2025

Choose a reason for hiding this comment

Uh oh!

randhircs Aug 11, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dnlfm commented Jun 30, 2025 •

edited

Loading

dnlfm commented Jul 22, 2025 •

edited

Loading

randhircs commented Jul 24, 2025 •

edited

Loading

dnlfm commented Jul 25, 2025 •

edited

Loading

dnlfm commented Jul 29, 2025 •

edited

Loading