build: focus Dependabot on security updates

[wenyt (wenytang-ms)]

Summary

• remove .github/dependabot.yml because its scheduled npm and GitHub Actions entries create frequent routine version-update pull requests that are not security-driven
• run the existing ADO CFS validation only for pull requests targeting main that modify npm or Maven dependency inputs used by the CI build
• keep Dependabot alerts and security-update pull requests controlled by the repository security settings

Why

The repository does not need frequent non-security dependency bump pull requests. The removed configuration scheduled those routine updates; it is not what enables Dependabot security updates.

Security updates can still open immediately when an alert has an available fix. Dependabot cooldown does not delay those updates, as demonstrated by #1923, so CFS availability needs to be enforced separately rather than through the scheduled Dependabot configuration.

Scope

The ADO PR trigger covers package.json, package-lock.json, Java extension POM files, the Maven wrapper distribution configuration, and the Maven coordinates resolved by scripts/buildJdtlsExt.js. Unrelated pull requests do not consume the CFS validation pipeline. The check is not currently required for main.

CFS validation is configured through the Azure DevOps pipeline VSCode-Test-Runner-CI-Build.

ADO validation

The first validation run, build 32033309, reached the CFS-authenticated npm install step and failed because fast-uri@3.1.7 was not present in the vscjava feed at that time. This was the expected gate behavior and confirmed that the pipeline detects dependency versions not yet available from CFS.

[Copilot]

🟡 Changes recommended

The required path-filtered check would block unrelated PRs, and fork validation needs secure credential handling.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Stops routine Dependabot updates while adding CFS validation for dependency PRs.

Changes:

• Removes scheduled npm and GitHub Actions updates.
• Adds Azure PR triggers for npm manifest changes.

File summaries

File	Description
.github/dependabot.yml	Removes scheduled version updates.
.azure-pipelines/vscode-java-test-ci.yml	Adds CFS-backed dependency PR validation.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wenyt (wenytang-ms)]

ADO CFS validation is now active through VSCode-Test-Runner-CI-Build.

The first run, build 32033309, is attached to this PR as the VSCode-Test-Runner-CI-Build check. It failed at the CFS-authenticated npm install because fast-uri@3.1.7 is not present in the vscjava feed. This is the expected result and confirms that the pipeline blocks package versions unavailable from CFS.

[Copilot]

🟢 Approval recommended

The focused configuration removal matches the stated scope without affecting Dependabot security updates.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0 new
• Review effort level: Balanced