Use a relative exclude-paths in dependabot.yml and a wildcard

[maurycy]

Unfortunately, #407 is incorrect, as demonstrated by #408: /pyperformance/data-files/benchmarks/bm_dulwich_log should be exluded.

It's not exactly clear to me why:

1. is exclude-paths relative to the directory?
2. is it because exclude-paths needs a wildcard?
3. is it because exclude-paths doesn't care about security updates?

It's impossible to test, and there are three sources of knowledge on the subject:

• The docs: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
• The thread, where Dependabot developers reply: Ignore manifests in specific subdirectories dependabot/dependabot-core#4364
• Existing dependabot.yaml files across the Github universe: https://github.com/search?q=path%3Adependabot.yml+exclude-paths&type=code

My – possibly incorrect – understanding is that 1. is true, 2. is likely true, and 3. is not definite (does "update PR creation" include security?) from reading comments:

dependabot/dependabot-core#4364 (comment)

I think that we can revert #296 once we confirm that it's indeed the fix.

[hugovk]

🤞

[dnlfm]

Interesting.. The previous version should have worked as well. May be some regression in how Dependabot is trying to filter paths @hugovk

[hugovk]

One idea is to enable Dependabot in your fork, and then you can iterate more quickly to find a solution? (If there is one :)

[hugovk]

Or maybe this is working?

#411 is an expected update in the top-level pyproject.toml

[maurycy]

@hugovk Thank you for a quick review. Great idea!

🤞 for now.

@dnlfm Maybe it's the relative path?

https://github.com/python/pyperformance/pull/409/files#diff-dd4fbda47e51f1e35defb9275a9cd9c212ecde0b870cba89ddaaae65c5f3cd28R4

[dnlfm]

Hmm yeah..
I'm not an official maintainer of Dependabot - I just contributed in this file-fetching part, so I can't say in an accurate way what could be the real issue... Right now the logic has been moved away from the FileFetcher, so it could be because of the value of directory, making the exclude-paths relative to it.

Before, it would be relative to the root of the project. I'm not sure if the value for directory forces the "root" be another one (it might be)