For wildcard / globbing support in the dependabot.yml file, what behavior would you expect to see if directories overlap?

[carlincherry]

A quick informal straw poll for a gut check: what behavior would you expect to see if directories overlap?

I.e.

Given an existing configuration file like 👇

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "monthly"
    reviewers: ["@person1"]

  - package-ecosystem: "npm"
    directories:
      - "/frontend"
    schedule:
      interval: "weekly"
    reviewers: ["@person2"]

  - package-ecosystem: "npm"
    directories:
      - "/backend"
    schedule:
      interval: "daily"
    reviewers: ["@person3"]

And a user adds the following entry 👇

  - package-ecosystem: "npm"
    directories:
      - "**/*"
    schedule:
      interval: "daily"
    reviewers: ["@person4"]

When would you expect or want Dependabot to run? And who would you expect or want to be assigned as a reviewer?

[tylerbenson]

More specific should take priority.

foo/bar/baz should be applied over foo/bar/* which should take priority over foo/**/baz.

[lucacome]

add a "negation" functionality to make configuration + customization easier

Can you expand on how this would work? Maybe an example of a configuration?

[carlincherry]

Something like this:

updates:
  - ecosystem: npm
    directories: 
      - "**/*"
      - "!foo/bar"
      - "!foo/baz"
    assignees: ["carlin"]
  - ecosystem: npm
    directories:
        - foo/bar
        - foo/baz
    assignees: ["nish"]

[MoFtZ]

Something else (will comment below)

I would expect each entry to be applied sequentially.

If I add the **/* entry to the bottom of the file, then it will be applied last, and daily updates sent to person4 for every folder in the repo - effectively replacing all the previous entries.

If I add the **/* entry to the top of the file, then it will be applied first. And the other three entries will override the daily/person4 behaviour for their selected directories only.

Negation functionality would be great, but there can still be bad configurations that introduce overlaps. Sequentially applying the rules will give predictability.

UPDATE: Having said that, I could also understand if the rules were applied sequentially, and the first matching rule is used.

[carlincherry]

Thank you for all of your input! This validates to us that there are a number of different ways to support wildcard / globbing. We really like a lot of the ideas threaded too.

We're going to start with this functionality. Starting here will get globbing out the fastest, and it doesn't prevent us later from using another strategy like a specificity algorithm or sequential execution order in the future.

Don't allow overlapping directories per ecosystem; add a "negation" functionality to make configuration + customization easier