dependabot ignore directory config error in dependabot.yml

Fixes Dependabot opening update PRs for a directory that was excluded with ignore rules or a paths exclusion. Use when dependabot.yml excludes a directory or dependency but PRs still appear for it. Not for Dependabot security updates, which ignore config exclusions by design, or for grouped update and schedule problems.

Identify whether the unwanted PRs are version updates or security updates by reading the PR label and branch name in the repository.

Open the dependabot configuration and find the update entry whose package ecosystem and directory match the PR exactly, including a leading slash on the directory.

Check the ignore rule inside that entry: the dependency name must match the manifest name exactly, and a version rule must use the supported condition syntax for ignoring all versions or a range.

Validate the whole file with a YAML parser and the Dependabot configuration checker, since a silent syntax error makes the whole file ignored.

Close the already open unwanted PRs with a comment noting the exclusion; Dependabot does not auto-close version PRs when a new ignore rule lands.

Trigger a fresh Dependabot check from the insights dependency graph page or wait for the next scheduled run.

Resolved from the public problem: https://vectle.com/posts/pst_g94VcvdVv0ixhMRRQlIC5g

Problem query: dependabot exclude paths not working: updates still open for excluded directory

TL;DR: Most exclude failures are one of three things: the ignore rule names the dependency or version pattern wrong, the exclusion was added to the wrong update entry for that ecosystem and directory, or the open PRs are security updates, which deliberately bypass ignore rules. Match the rule to the exact entry, close the stale PRs once, and verify with a fresh check run.

Not specified by the original author.

TL;DR

Use the exclude-paths option in the dependabot.yml update entry to list directories Dependabot should skip, e.g. the experiments folder. This applies per update entry, so set it on each ecosystem block that scans near the excluded paths.

Steps

1. Use the exclude-paths option in the dependabot.yml update entry to list directories Dependabot should skip, e.g. the experiments folder. This applies per update entry, so set it on each ecosystem block that scans near the excluded paths. It keeps the noise PRs away without moving the experiments out of the repo or disabling Dependabot for the directories you do care about.

When to use

You are seeing this: It keeps the noise PRs away without moving the experiments out of the repo or disabling Dependabot for the directories you do care about. Use this skill when you run into "Exclude directories like experiments from Dependabot updates".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Stack Overflow #65275433 (accepted answer, 37 votes): the asker has an /experiments directory full of one-off package.json files they never intend to maintain, but Dependabot keeps opening PRs for them. The accepted answer notes this was impossible for years and is now supported via configuration.

Verified resolution: Use the exclude-paths option in the dependabot.yml update entry to list directories Dependabot should skip, e.g. the experiments folder. This applies per update entry, so set it on each ecosystem block that scans near the excluded paths. It keeps the noise PRs away without moving the experiments out of the repo or disabling Dependabot for the directories you do care about.

Source URL: https://stackoverflow.com/questions/65275433/can-i-exclude-directories-from-github-dependabot

Not specified by the original author.

TL;DR

To exclude directories for the open source part, you need to: In an SCM import, add the list to exclude (screenshot) In a CLI import, add the directories as arguments (syntax below) --exclude=DIRECTORY[,DIRECTORY]...> (only in test and monitor commands) Can be used with --all-projects and --yarn-workspaces to indicate sub-directories and files to exclude. This is confusing because these are two separate mechanisms.

When to use

You are seeing this: From the accepted Stack Overflow answer: Yes, unfortunately this is confusing today. Use this skill when you run into "How do we ignore folders in Snyk".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

From the accepted Stack Overflow answer: Yes, unfortunately this is confusing today. For historical reasons, the .snyk file only applies to Snyk Code (SAST). To exclude directories for the open source part, you need to: In an SCM import, add the list to exclude (screenshot) In a CLI import, add the directories as arguments (syntax below) --exclude=DIRECTORY[,DIRECTORY]...> (only in test and monitor commands) Can be used with --all-projects and --yarn-workspaces to indicate sub-directories and files to exclude. Must be comma separated. This is confusing because these are two separate mechanisms. In the future, both mechanisms will be the same, but for now, both need to be done.

Context: Problem: Accepted solution (score 5): Yes, unfortunately this is confusing today. For historical reasons, the .snyk file only applies to Snyk Code (SAST). To exclude directories for the open source part, you need to: In an SCM import, add the list to exclude (screenshot) In a CLI import, add the directories as arguments (syntax below) --exclude=DIRECTORY[,DIRECTORY]...> (only in test and monitor commands) Can be used with --all-projects and --yarn-workspaces to indicate sub-directories and files to exclude. Must be comma separated. This is confusing because these are two separate mechanisms. In the future, both mechanisms will be the same, but for now, both need to be done.

Source: Problem: Accepted solution (score 5): Yes, unfortunately this is confusing today. For historical reasons, the .snyk file only applies to Snyk Code (SAST). To exclude directories for the open source part, you need to: In an SCM import, add the list to exclude (screenshot) In a CLI import, add the directories as arguments (syntax below) --exclude=DIRECTORY[,DIRECTORY]...> (only in test and monitor commands) Can be used with --all-projects and --yarn-workspaces to indicate sub-directories and files to exclude. Must be comma separated. This is confusing because these are two separate mechanisms. In the future, both mechanisms will be the same, but for now, both need to be done.

Verified resolution: From the accepted Stack Overflow answer: Yes, unfortunately this is confusing today. For historical reasons, the .snyk file only applies to Snyk Code (SAST). To exclude directories for the open source part, you need to: In an SCM import, add the list to exclude (screenshot) In a CLI import, add the directories as arguments (syntax below) --exclude=DIRECTORY[,DIRECTORY]...> (only in test and monitor commands) Can be used with --all-projects and --yarn-workspaces to indicate sub-directories and files to exclude. Must be comma separated. This is confusing because these are two separate mechanisms. In the future, both mechanisms will be the same, but for now, both need to be done.

Source URL: https://stackoverflow.com/questions/76145644/how-do-we-ignore-folders-in-snyk