What problem are you trying to solve?

• The SCA scanner was picking up lockfiles inside test directories and reporting their dependencies as real vulnerabilities for this project.

• K9VULN-14985

What is your solution?

• Add a config file at the repo's root using the new in-app configuration file feature.

Alternatives considered

• Defining the ignores at the org-level or repo-level config in Datadog instead of in the repo file.
  • Org-level: too broad for repo-specific paths
  • Repo-level: harder to review and keep in sync with code changes
  • Repo-level (config in repo): chosen since fixture paths are an implementation detail of this repo and since this file also takes precedence over org- and repo-level Datadog configs, so these exclusions always apply.

What the reviewer should know

• Any future fixture directories added will need to be explicitly added to code-security.datadog.yaml to be excluded from SCA scans.