From d76d0c6660ceda896d7099873b7e5bc593f0090e Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Mon, 20 Jul 2026 17:44:26 +0900
Subject: [PATCH] fix(dependabot): remove invalid root npm target

---
 .github/dependabot.yml                   |  5 ----
 backend/tests/test_release_governance.py | 30 ++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 237e6bf29..e9e7df328 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -63,8 +63,3 @@ updates:
     directory: /connector
     schedule:
       interval: daily
-
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: daily
diff --git a/backend/tests/test_release_governance.py b/backend/tests/test_release_governance.py
index fffbde5d5..f96ba9267 100644
--- a/backend/tests/test_release_governance.py
+++ b/backend/tests/test_release_governance.py
@@ -43,6 +43,36 @@ def read_repo_text(relative_path: str) -> str:
     return path.read_text(encoding="utf-8")
 
 
+def test_dependabot_update_directories_have_manifests() -> None:
+    """Keep each Dependabot ecosystem rooted at a directory it can update."""
+    config = yaml.safe_load(read_repo_text(".github/dependabot.yml"))
+    manifest_patterns = {
+        "docker": ("Dockerfile*",),
+        "github-actions": (".github/workflows",),
+        "npm": ("package.json",),
+        "pip": ("pyproject.toml", "requirements*.txt", "setup.py"),
+    }
+    update_keys: set[tuple[str, str]] = set()
+
+    for update in config["updates"]:
+        ecosystem = update["package-ecosystem"]
+        directory = update["directory"]
+        update_key = (ecosystem, directory)
+        assert update_key not in update_keys, (
+            f"duplicate Dependabot update target: {ecosystem} {directory}"
+        )
+        update_keys.add(update_key)
+
+        target_directory = REPO_ROOT / directory.removeprefix("/")
+        expected_patterns = manifest_patterns[ecosystem]
+        assert any(
+            any(target_directory.glob(pattern)) for pattern in expected_patterns
+        ), (
+            f"Dependabot {ecosystem} target {directory} has none of "
+            f"{', '.join(expected_patterns)}"
+        )
+
+
 def assert_dockerfile_stage_from(dockerfile: str, image: str, stage_alias: str) -> None:
     pattern = (
         rf"^FROM {re.escape(image)}@sha256:[0-9a-f]{{64}} AS {re.escape(stage_alias)}$"