Skip to content

Configuring dependabot to ignore fine-tuning folder in gke/ai-ml/playground #460

Open
karajendran wants to merge 3 commits into
mainfrom
ignore-playground-mft
Open

Configuring dependabot to ignore fine-tuning folder in gke/ai-ml/playground #460
karajendran wants to merge 3 commits into
mainfrom
ignore-playground-mft

Conversation

@karajendran

@karajendran karajendran commented Jun 4, 2026

Copy link
Copy Markdown
Collaborator

This PR configures Dependabot to ignore the following folders:
/use-cases/model-fine-tuning-pipeline/fine-tuning/
use-cases/model-fine-tuning-pipeline/data-preparation/

Since the fine-tuning use case has been migrated from gke/ai-ml/playground to gke/base/platform, we no longer need Dependabot tracking dependencies in thess playground paths.

@karajendran karajendran requested review from alizaidis and arueth June 4, 2026 18:27
@karajendran karajendran changed the title Configuring dependabot to ignore fine-tuing folder in gke/ai-ml/playground Configuring dependabot to ignore fine-tuning folder in gke/ai-ml/playground Jun 4, 2026

@ferrarimarco ferrarimarco left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is likely not the way we want to go.

Dependabot is not currently configured for regular dependency updates (IIRC, @prev-dev is working on that). The Dependabot PRs you see are all about updating dependencies with known vulnerabilities, not about general dependency updates.

We likely don't want to leave stuff around that installs known vulnerable dependencies.

My 2c: if something is deprecated, we should actually remove it from the repository. If anyone needs that, they have Git history to get it back.

Finally, this Dependabot configuration will not do what you likely intend it to do . The result of applying this configuration will be that Dependabot will start proposing ungrouped version updates for dependencies listed in /requirements.txt.

It will not stop proposing security updates for the paths you listed in exclude-paths.

Because:

  • /requirements.txt doesn't include the dependencies you intend to ignore.
  • The directory: "/" entry doesn't recurse to subdirectories.
  • You didn't specify an applies-to. The default for applies to is version-updates, not security-updates.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants