Walkthrough

The .gitattributes file gains eleven lines marking several fixture directory patterns (fixtures/, __fixtures__/, findPackages-fixtures/, pnpr/.fixtures/) as linguist-generated, causing GitHub to collapse those trees and exclude them from the dependency graph and security alerting.

Changes

Fixture directory linguist attributes

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Suggested labels

product: pnpm, product: pnpr

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

• X
• Mastodon
• Reddit
• LinkedIn

• Mark common fixture directories as linguist-generated to exclude their manifests from GitHub’s
 dependency graph.
• Prevent Dependabot security alerts/PRs for packages referenced only in test fixtures.
• Leave real source (e.g. __utils__/test-fixtures) unmarked to preserve normal scanning.

graph TD
  Dev["Repo contributors"] --> GA[".gitattributes rules"] --> GH["GitHub Linguist"] --> DG["Dependency graph"] --> DB["Dependabot"]
  FX["Fixture trees"] --> GA
  subgraph Legend
    direction LR
    _cfg["Config"] ~~~ _svc["GitHub service"] ~~~ _data["Repo content"]
  end

Loading

The following are alternative approaches to this PR:

1. Move fixtures under GitHub-excluded directory names (e.g. external/ or vendor/)

• ➕ Relies on documented dependency-graph exclusions by directory name
• ➕ Less dependent on Linguist/dependency-graph implementation coupling
• ➖ Higher churn: path changes across many fixtures
• ➖ Risk of breaking tests/tools that assume existing fixture paths
• ➖ Larger diff and review surface area

2. Delete/flatten fixture manifests (replace package.json with minimal metadata)

• ➕ Eliminates dependency-graph inputs at the source
• ➕ May reduce fixture maintenance long-term
• ➖ Likely invalidates fixture realism needed for resolver/install tests
• ➖ Requires wider test refactors and could reduce coverage fidelity

3. Use separate repo/submodule for fixtures

• ➕ Clean separation from primary repo dependency graph
• ➕ Can apply different scanning policies
• ➖ Operational overhead (syncing, CI wiring)
• ➖ Harder contributor workflow and review process

Recommendation: The .gitattributes linguist-generated approach is the best tradeoff: minimal churn, preserves fixture structure, and targets GitHub’s indexing behavior directly. Proceed with this change, but explicitly perform the post-merge verification in GitHub’s Dependency graph/Dependabot as noted; if GitHub doesn’t honor the classification for dependency graph, fall back to relocating fixtures under a documented-excluded directory name.

Other (1) +11 / -0

.gitattributesMark fixture directories as linguist-generated to suppress dependency scanning +11/-0

Mark fixture directories as linguist-generated to suppress dependency scanning

• Adds 'linguist-generated' patterns for common fixture directory trees ('fixtures', '__fixtures__', 'findPackages-fixtures', 'pnpr/.fixtures'). Includes comments explaining the Dependabot/dependency-graph motivation and explicitly avoids matching real source like '__utils__/test-fixtures'.

.gitattributes