From 216e6aa9d339fe762cf2a73ed27e3703650ae407 Mon Sep 17 00:00:00 2001
From: Nick Cross <ncross@redhat.com>
Date: Wed, 2 Sep 2026 08:48:23 +0100
Subject: [PATCH 1/2] Add gradle and scala

---
 .github/dependabot.yml | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index bdc79c1..2170e2e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,7 +4,36 @@
 # https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
 version: 2
 updates:
-  - package-ecosystem: "maven" # See documentation for possible values
+  # Uncomment the appropriate ecosystem for each repository
+  # - package-ecosystem: "gradle"
+  #   directory: "/" # Location of package manifests
+  #   schedule:
+  #     interval: "weekly"
+  #   # wait after a new release till we create a PR, to reduce risk of pulling
+  #   # a compromised new version
+  #   cooldown:
+  #     default-days: 7
+  #     # Exclude our own repos from cooldown
+  #     # https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#cooldown-
+  #     exclude:
+  #       - "org.jboss.da:*"
+  #       - "org.jboss.pnc*:*"        # match org.jboss.pnc:xyz and org.jboss.pnc.group:xyz
+  #       - "org.commonjava*:*"       # match org.commonjava:xyz and org.commonjava.group:xyz
+  # - package-ecosystem: "sbt"
+  #   directory: "/" # Location of package manifests
+  #   schedule:
+  #     interval: "weekly"
+  #   # wait after a new release till we create a PR, to reduce risk of pulling
+  #   # a compromised new version
+  #   cooldown:
+  #     default-days: 7
+  #     # Exclude our own repos from cooldown
+  #     # https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#cooldown-
+  #     exclude:
+  #       - "org.jboss.da:*"
+  #       - "org.jboss.pnc*:*"        # match org.jboss.pnc:xyz and org.jboss.pnc.group:xyz
+  #       - "org.commonjava*:*"       # match org.commonjava:xyz and org.commonjava.group:xyz
+  - package-ecosystem: "maven"
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"

From de39319d8068cd2aa29a20299f30698256888f2c Mon Sep 17 00:00:00 2001
From: Nick Cross <ncross@redhat.com>
Date: Wed, 2 Sep 2026 09:15:56 +0100
Subject: [PATCH 2/2] Comment out maven ecosystem. Add note in README

---
 .github/dependabot.yml | 31 +++++++++++++++++--------------
 README.md              |  2 ++
 2 files changed, 19 insertions(+), 14 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 2170e2e..5a71373 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,7 +4,9 @@
 # https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
 version: 2
 updates:
+  #
   # Uncomment the appropriate ecosystem for each repository
+  #
   # - package-ecosystem: "gradle"
   #   directory: "/" # Location of package manifests
   #   schedule:
@@ -33,20 +35,21 @@ updates:
   #       - "org.jboss.da:*"
   #       - "org.jboss.pnc*:*"        # match org.jboss.pnc:xyz and org.jboss.pnc.group:xyz
   #       - "org.commonjava*:*"       # match org.commonjava:xyz and org.commonjava.group:xyz
-  - package-ecosystem: "maven"
-    directory: "/" # Location of package manifests
-    schedule:
-      interval: "weekly"
-    # wait after a new release till we create a PR, to reduce risk of pulling
-    # a compromised new version
-    cooldown:
-      default-days: 7
-      # Exclude our own repos from cooldown
-      # https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#cooldown-
-      exclude:
-        - "org.jboss.da:*"
-        - "org.jboss.pnc*:*"        # match org.jboss.pnc:xyz and org.jboss.pnc.group:xyz
-        - "org.commonjava*:*"       # match org.commonjava:xyz and org.commonjava.group:xyz
+  # - package-ecosystem: "maven"
+  #   directory: "/" # Location of package manifests
+  #   schedule:
+  #     interval: "weekly"
+  #   # wait after a new release till we create a PR, to reduce risk of pulling
+  #   # a compromised new version
+  #   cooldown:
+  #     default-days: 7
+  #     # Exclude our own repos from cooldown
+  #     # https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#cooldown-
+  #     exclude:
+  #       - "org.jboss.da:*"
+  #       - "org.jboss.pnc*:*"        # match org.jboss.pnc:xyz and org.jboss.pnc.group:xyz
+  #       - "org.commonjava*:*"       # match org.commonjava:xyz and org.commonjava.group:xyz
+
   - package-ecosystem: "github-actions" # Also update Github actions
     directory: "/"
     schedule:
diff --git a/README.md b/README.md
index ea4453d..d41d3a1 100644
--- a/README.md
+++ b/README.md
@@ -477,6 +477,8 @@ Also has a `TAGS` property to associate Mend scan run with some data (e.g. branc
 
 A sample dependabot file in `.github/dependabot.yml` is available that is both used in this repository and may be copied to other ProjectNCL repositories.
 
+**NOTE** - the developer must uncomment the appropriate package ecosystem when copying the file.
+
 ## GitHub Releases
 A sample `.github/release.yml` configuration file from the [GitHub documentation](https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes#configuring-automatically-generated-release-notes) has been added that may be copied to other ProjectNCL repositories.