fix: suppress dependabot security updates for all test fixture manifests

.github/dependabot.yml

@@ -12,67 +12,80 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-
-  # ── Non-production ecosystems (no real deps, suppress everything) ────
-  # The repo has no production npm/pip/go/gradle/cargo dependencies.
-  # A root-level ignore-all entry ensures security updates are also
-  # suppressed, since per-directory entries with globs don't reliably
-  # block them.
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "monthly"
-    open-pull-requests-limit: 0
-    labels: []
-    ignore:
-      - dependency-name: "*"
-  - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "monthly"
-    open-pull-requests-limit: 0
-    labels: []
-    ignore:
-      - dependency-name: "*"
-  - package-ecosystem: "uv"
-    directory: "/"
+# ── BEGIN GENERATED: test fixture suppressions
+  # Auto-generated by scripts/sync-dependabot-config.sh.
+  # Do not edit manually — run the script to update.
+  - package-ecosystem: "cargo"
+    directories:
+      - "/src/test/resources/tst_manifests/cargo/license/cargo_with_license"
+      - "/src/test/resources/tst_manifests/cargo/license/cargo_without_license"
+      - "/src/test/resources/tst_manifests/cargo/license/cargo_workspace_license_inheritance"
+      - "/src/test/resources/tst_manifests/cargo/license/cargo_workspace_license_inheritance_no_license"
     schedule:
       interval: "monthly"
     open-pull-requests-limit: 0
     labels: []
     ignore:
       - dependency-name: "*"
   - package-ecosystem: "gomod"
-    directory: "/"
+    directories:
+      - "/src/test/resources/msc/golang"
+      - "/src/test/resources/msc/golang/mvs_logic"
+      - "/src/test/resources/tst_manifests/golang/go_mod_light_no_ignore"
+      - "/src/test/resources/tst_manifests/golang/go_mod_no_ignore"
+      - "/src/test/resources/tst_manifests/golang/go_mod_no_path"
+      - "/src/test/resources/tst_manifests/golang/go_mod_with_all_ignore"
+      - "/src/test/resources/tst_manifests/golang/go_mod_with_ignore"
+      - "/src/test/resources/tst_manifests/golang/go_mod_with_one_ignored_prefix_go"
+      - "/src/test/resources/tst_manifests/it/golang"
+      - "/src/test/resources/tst_manifests/workspace/go/go_workspace/module-a"
+      - "/src/test/resources/tst_manifests/workspace/go/go_workspace/module-b"
+      - "/src/test/resources/tst_manifests/workspace/go/go_workspace_missing_module/existing"
+      - "/src/test/resources/tst_manifests/workspace/go/go_workspace_nested/libs/core"
+      - "/src/test/resources/tst_manifests/workspace/go/go_workspace_nested/libs/util"
+      - "/src/test/resources/tst_manifests/workspace/go/go_workspace_single/mymod"
     schedule:
       interval: "monthly"
     open-pull-requests-limit: 0
     labels: []
     ignore:
       - dependency-name: "*"
   - package-ecosystem: "gradle"
-    directory: "/"
-    schedule:
-      interval: "monthly"
-    open-pull-requests-limit: 0
-    labels: []
-    ignore:
-      - dependency-name: "*"
-  - package-ecosystem: "cargo"
-    directory: "/"
+    directories:
+      - "/src/test/resources/tst_manifests/gradle-groovy/deps_with_duplicate_different_versions"
+      - "/src/test/resources/tst_manifests/gradle-groovy/deps_with_duplicate_no_version"
+      - "/src/test/resources/tst_manifests/gradle-groovy/deps_with_ignore_full_specification"
+      - "/src/test/resources/tst_manifests/gradle-groovy/deps_with_ignore_named_params"
+      - "/src/test/resources/tst_manifests/gradle-groovy/deps_with_ignore_notations"
+      - "/src/test/resources/tst_manifests/gradle-groovy/deps_with_no_ignore_common_paths"
+      - "/src/test/resources/tst_manifests/gradle-groovy/empty"
+      - "/src/test/resources/tst_manifests/gradle-kotlin/deps_with_duplicate_different_versions"
+      - "/src/test/resources/tst_manifests/gradle-kotlin/deps_with_duplicate_no_version"
+      - "/src/test/resources/tst_manifests/gradle-kotlin/deps_with_ignore_full_specification"
+      - "/src/test/resources/tst_manifests/gradle-kotlin/deps_with_ignore_named_params"
+      - "/src/test/resources/tst_manifests/gradle-kotlin/deps_with_ignore_notations"
+      - "/src/test/resources/tst_manifests/gradle-kotlin/deps_with_no_ignore_common_paths"
+      - "/src/test/resources/tst_manifests/gradle-kotlin/empty"
+      - "/src/test/resources/tst_manifests/it/gradle-groovy"
+      - "/src/test/resources/tst_manifests/it/gradle-kotlin"
+      - "/src/test/resources/tst_manifests/workspace/gradle/gradle_missing_subproject"
+      - "/src/test/resources/tst_manifests/workspace/gradle/gradle_missing_subproject/app"
+      - "/src/test/resources/tst_manifests/workspace/gradle/gradle_mixed_variants"
+      - "/src/test/resources/tst_manifests/workspace/gradle/gradle_mixed_variants/app"
+      - "/src/test/resources/tst_manifests/workspace/gradle/gradle_mixed_variants/lib"
+      - "/src/test/resources/tst_manifests/workspace/gradle/gradle_multi_project"
+      - "/src/test/resources/tst_manifests/workspace/gradle/gradle_multi_project/app"
+      - "/src/test/resources/tst_manifests/workspace/gradle/gradle_multi_project/lib"
+      - "/src/test/resources/tst_manifests/workspace/gradle/gradle_nested_subprojects"
+      - "/src/test/resources/tst_manifests/workspace/gradle/gradle_nested_subprojects/libs/core"
+      - "/src/test/resources/tst_manifests/workspace/gradle/gradle_nested_subprojects/libs/util"
+      - "/src/test/resources/tst_manifests/workspace/gradle/gradle_no_subprojects"
     schedule:
       interval: "monthly"
     open-pull-requests-limit: 0
     labels: []
     ignore:
       - dependency-name: "*"
-
-  # ── Test fixture manifests (maven only) ──────────────────────────────
-  # Maven is the production ecosystem so it cannot use a root-level
-  # ignore-all. Glob patterns (/**) don't reliably match nested
-  # subdirectories for security updates, so every directory containing
-  # a pom.xml is listed explicitly. Update this list when adding new
-  # test fixtures.
   - package-ecosystem: "maven"
     directories:
       - "/src/test/resources/tst_manifests/it/maven"
@@ -85,15 +98,131 @@ updates:
       - "/src/test/resources/tst_manifests/maven/deps_with_ignore_on_version"
       - "/src/test/resources/tst_manifests/maven/deps_with_ignore_on_wrong"
       - "/src/test/resources/tst_manifests/maven/deps_with_no_ignore"
+      - "/src/test/resources/tst_manifests/maven/deps_with_version_range"
       - "/src/test/resources/tst_manifests/maven/empty"
       - "/src/test/resources/tst_manifests/maven/license/pom_with_empty_license"
       - "/src/test/resources/tst_manifests/maven/license/pom_with_license"
       - "/src/test/resources/tst_manifests/maven/license/pom_with_multiple_licenses"
       - "/src/test/resources/tst_manifests/maven/license/pom_without_license"
       - "/src/test/resources/tst_manifests/maven/pom_deps_with_no_ignore_common_paths"
       - "/src/test/resources/tst_manifests/maven/pom_deps_with_no_ignore_provided_scope"
+      - "/src/test/resources/tst_manifests/workspace/maven/maven_missing_module"
+      - "/src/test/resources/tst_manifests/workspace/maven/maven_missing_module/module-a"
+      - "/src/test/resources/tst_manifests/workspace/maven/maven_multi_module"
+      - "/src/test/resources/tst_manifests/workspace/maven/maven_multi_module/module-a"
+      - "/src/test/resources/tst_manifests/workspace/maven/maven_multi_module/module-b"
+      - "/src/test/resources/tst_manifests/workspace/maven/maven_nested_aggregator"
+      - "/src/test/resources/tst_manifests/workspace/maven/maven_nested_aggregator/parent"
+      - "/src/test/resources/tst_manifests/workspace/maven/maven_nested_aggregator/parent/child"
+      - "/src/test/resources/tst_manifests/workspace/maven/maven_no_modules"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 0
+    labels: []
+    ignore:
+      - dependency-name: "*"
+  - package-ecosystem: "npm"
+    directories:
+      - "/src/test/resources/tst_manifests/it/npm"
+      - "/src/test/resources/tst_manifests/it/pnpm"
+      - "/src/test/resources/tst_manifests/it/yarn"
+      - "/src/test/resources/tst_manifests/npm/deps_with_ignore"
+      - "/src/test/resources/tst_manifests/npm/deps_with_mixed_dep_types"
+      - "/src/test/resources/tst_manifests/npm/deps_with_no_ignore"
+      - "/src/test/resources/tst_manifests/npm/deps_with_no_version_root_dep"
+      - "/src/test/resources/tst_manifests/npm/empty"
+      - "/src/test/resources/tst_manifests/npm/license/package_with_legacy_licenses"
+      - "/src/test/resources/tst_manifests/npm/license/package_with_license"
+      - "/src/test/resources/tst_manifests/npm/license/package_without_license"
+      - "/src/test/resources/tst_manifests/pnpm/deps_with_ignore"
+      - "/src/test/resources/tst_manifests/pnpm/deps_with_mixed_dep_types"
+      - "/src/test/resources/tst_manifests/pnpm/deps_with_no_ignore"
+      - "/src/test/resources/tst_manifests/workspace/package_json_array"
+      - "/src/test/resources/tst_manifests/workspace/package_json_array/packages/lib-a"
+      - "/src/test/resources/tst_manifests/workspace/package_json_array/packages/lib-b"
+      - "/src/test/resources/tst_manifests/workspace/package_json_object"
+      - "/src/test/resources/tst_manifests/workspace/package_json_object/packages/mod-a"
+      - "/src/test/resources/tst_manifests/workspace/pnpm_workspace/packages/pkg-a"
+      - "/src/test/resources/tst_manifests/workspace/pnpm_workspace/packages/pkg-b"
+      - "/src/test/resources/tst_manifests/workspace/with_invalid"
+      - "/src/test/resources/tst_manifests/workspace/with_invalid/packages/no_name"
+      - "/src/test/resources/tst_manifests/workspace/with_invalid/packages/no_version"
+      - "/src/test/resources/tst_manifests/workspace/with_invalid/packages/valid"
+      - "/src/test/resources/tst_manifests/yarn-berry/deps_with_ignore"
+      - "/src/test/resources/tst_manifests/yarn-berry/deps_with_mixed_dep_types"
+      - "/src/test/resources/tst_manifests/yarn-berry/deps_with_no_ignore"
+      - "/src/test/resources/tst_manifests/yarn-classic/deps_with_ignore"
+      - "/src/test/resources/tst_manifests/yarn-classic/deps_with_mixed_dep_types"
+      - "/src/test/resources/tst_manifests/yarn-classic/deps_with_no_ignore"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 0
+    labels: []
+    ignore:
+      - dependency-name: "*"
+  - package-ecosystem: "pip"
+    directories:
+      - "/src/test/resources/tst_manifests/it/pypi"
+      - "/src/test/resources/tst_manifests/pip/pip_pyproject_toml_ignore"
+      - "/src/test/resources/tst_manifests/pip/pip_pyproject_toml_no_ignore"
+      - "/src/test/resources/tst_manifests/pip/pip_pyproject_toml_no_metadata"
+      - "/src/test/resources/tst_manifests/pip/pip_pyproject_toml_pep621_license"
+      - "/src/test/resources/tst_manifests/pip/pip_pyproject_toml_poetry"
+      - "/src/test/resources/tst_manifests/pip/pip_pyproject_toml_poetry_license"
+      - "/src/test/resources/tst_manifests/pip/pip_pyproject_toml_uv"
+      - "/src/test/resources/tst_manifests/pip/pip_pyproject_toml_uv_ignore"
+      - "/src/test/resources/tst_manifests/pip/pip_requirements_txt_ignore"
+      - "/src/test/resources/tst_manifests/pip/pip_requirements_txt_marker_installed"
+      - "/src/test/resources/tst_manifests/pip/pip_requirements_txt_marker_skip"
+      - "/src/test/resources/tst_manifests/pip/pip_requirements_txt_no_ignore"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace/packages/mid-pkg"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace/packages/sub-pkg"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_exclude"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_exclude/packages/core"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_exclude/packages/internal"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_nested"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_nested/apps/backend"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_nested/libs/core"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_no_config"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_no_lock"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_virtual"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_virtual/packages/pkg-a"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_virtual/packages/pkg-b"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 0
+    labels: []
+    ignore:
+      - dependency-name: "*"
+  - package-ecosystem: "uv"
+    directories:
+      - "/src/test/resources/tst_manifests/pip/pip_pyproject_toml_ignore"
+      - "/src/test/resources/tst_manifests/pip/pip_pyproject_toml_no_ignore"
+      - "/src/test/resources/tst_manifests/pip/pip_pyproject_toml_no_metadata"
+      - "/src/test/resources/tst_manifests/pip/pip_pyproject_toml_pep621_license"
+      - "/src/test/resources/tst_manifests/pip/pip_pyproject_toml_poetry"
+      - "/src/test/resources/tst_manifests/pip/pip_pyproject_toml_poetry_license"
+      - "/src/test/resources/tst_manifests/pip/pip_pyproject_toml_uv"
+      - "/src/test/resources/tst_manifests/pip/pip_pyproject_toml_uv_ignore"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace/packages/mid-pkg"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace/packages/sub-pkg"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_exclude"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_exclude/packages/core"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_exclude/packages/internal"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_nested"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_nested/apps/backend"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_nested/libs/core"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_no_config"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_no_lock"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_virtual"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_virtual/packages/pkg-a"
+      - "/src/test/resources/tst_manifests/workspace/uv/uv_workspace_virtual/packages/pkg-b"
     schedule:
       interval: "monthly"
+    open-pull-requests-limit: 0
     labels: []
     ignore:
       - dependency-name: "*"
+  # ── END GENERATED: test fixture suppressions

.github/workflows/pr.yml

@@ -7,6 +7,14 @@ on:
       - main
 
 jobs:
+  dependabot-config:
+    name: Verify dependabot config
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Check dependabot.yml covers all test fixture manifests
+        run: bash scripts/sync-dependabot-config.sh --check
+
   build:
     runs-on: ubuntu-latest
     name: Build and test Java ${{ matrix.java }}

CONVENTIONS.md

@@ -83,7 +83,7 @@ src/main/java/io/github/guacsec/trustifyda/
 
 ## Test Fixtures
 
-- **Dependabot suppression**: Test fixture directories contain intentionally pinned (sometimes vulnerable) dependencies. When adding a new test fixture directory with a manifest file, review `.github/dependabot.yml` to ensure the new path is covered. Non-maven ecosystems are suppressed via root-level `ignore: [{dependency-name: "*"}]` entries. Maven fixtures use per-directory entries with `/**` globs since maven is the production ecosystem; add the parent directory if a new maven fixture tree is introduced.
+- **Dependabot suppression**: Test fixture directories contain intentionally pinned (sometimes vulnerable) dependencies. Every directory containing a manifest file must be explicitly listed in `.github/dependabot.yml` with `ignore: [{dependency-name: "*"}]` to suppress both version and security update PRs. Run `scripts/sync-dependabot-config.sh` to regenerate the fixture entries automatically. CI enforces this via `--check` mode in the PR workflow.
 
 ## Dependencies