chore(deps): scope Dependabot to real manifests, ignore vulnerable test fixtures

[shivasurya]

Summary

Dependabot's auto-discovery walks every manifest in the repo. Without an explicit allowlist it picks up:

• ~70 go.mod files under rules/**/tests/{positive,negative,} (per-rule self-test modules)
• ~5 go.mod files under sast-engine/test-fixtures/golang/

These pin deliberately vulnerable dependency versions used to self-test pathfinder's rules (dgrijalva/jwt-go@v3.2.0 for GO-JWT-002, vulnerable gorm releases for GO-GORM-SQLI-*, etc.). Letting Dependabot file version-update PRs against them would break the very rules they exist to test.

This adds .github/dependabot.yml that explicitly lists the seven real manifest locations. Everything not listed is left untouched.

What gets tracked

Ecosystem	Path	Why
gomod	/sast-engine	The actual SAST engine
gomod	/sast-engine/tools/validate_go_resolution	Real internal tool
gradle	/sast-engine	Java build deps
pip	/python-sdk	Public Python SDK
pip	/sast-engine/tools/typeshed-converter	Real internal tool
npm	/extension/secureflow	VS Code extension root
npm	/extension/secureflow/packages/secureflow-cli	CLI subpackage
github-actions	/	All 15 workflow files

Minor/patch updates are grouped into one weekly PR per ecosystem to reduce noise; major updates remain individual for review. chore(deps) prefix matches the repo's commit convention.

Scope this does NOT cover

Dependabot alerts (Security tab) are not controlled by this file. Alerts come from the auto-built dependency graph, and there is no repo-file mechanism to path-exclude. To stop alert noise from the fixture manifests:

1. Go to Settings → Security → Dependabot → Auto-triage rules.
2. Add a rule with: paths matching rules/** or sast-engine/test-fixtures/**, action = "Auto-dismiss alert", reason = tolerable_risk (or not_used).

The header comment in dependabot.yml documents this.

A second follow-up is the self-scan workflow (code-pathfinder-scan.yml), which runs pathfinder on this repo: it doesn't pass --exclude rules --exclude sast-engine/test-fixtures yet. That needs an exclude input added to action.yml first, which is a separate PR.

Test plan

• YAML syntax valid (parses cleanly).
• Every listed directory: resolves to a real manifest file in this repo.
• No listed path overlaps with rules/ or sast-engine/test-fixtures/.
• Once merged: confirm via the Dependabot tab that only the 8 listed update configs appear (no auto-discovered entries from fixture manifests).

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

View complete scan results →

_{This report is generated by SafeDep Github App}

[github-actions]

Code Pathfinder Security Scan

No security issues detected.

Metric	Value
Files Scanned	1
Rules	205

---

_{Powered by Code Pathfinder}

[code-pathfinder]

Pathfinder Report

✅ No security findings on the changed files. This pull request is clean.

View report on the dashboard

---

Powered by Code Pathfinder.