Scope Dependabot to Maven and ignore provided-scope deps (#1289)

Spark, Scala, and Spark's Jackson libs are declared `provided` in the
poms — compiled against but not packaged into the Zingg jar. The Spark
runtime (Databricks/EMR/etc.) supplies and patches them, so Dependabot
PRs/alerts on these are noise. Ignore them; keep jackson-annotations
(compile scope, shipped) since its alerts are real.

Author: ChandanYdv0402

.github/dependabot.yml

@@ -1,11 +1,30 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+# Dependabot configuration for Zingg.
+# See: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+#
+# NOTE (issue #1289): Zingg runs *on top of* a Spark cluster (Databricks, EMR,
+# spark-submit classpath). Spark, Scala, and the Jackson libs Spark ships are
+# declared as `provided` scope in the poms — they are compiled against but NOT
+# packaged into the Zingg jar. The runtime environment supplies (and patches)
+# them. Zingg cannot choose their runtime version, so Dependabot PRs/alerts on
+# these are noise. We therefore `ignore` them below.
+# GitHub classifies Maven `provided` scope as "runtime" (not "development"), so
+# there is no built-in scope filter for this yet (dependabot-core#7973) — the
+# ignore list is the config-level lever, and pom <exclusions> remain the real
+# fix for transitive artifacts we must strip from the shipped graph.
 
 version: 2
 updates:
-  - package-ecosystem: "*" # See documentation for possible values
-    directory: "/" # Location of package manifests
+  - package-ecosystem: "maven"
+    directories:
+      - "/**" # cover the root + all Maven submodules (common/*, spark/*, ...)
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 10
+    ignore:
+      # --- provided scope: supplied by the Spark runtime, not shipped by Zingg ---
+      - dependency-name: "org.apache.spark:*"
+      - dependency-name: "org.scala-lang:*"
+      - dependency-name: "com.fasterxml.jackson.core:jackson-core"
+      - dependency-name: "com.fasterxml.jackson.core:jackson-databind"
+      # NOTE: jackson-annotations is `compile` scope (shipped in the jar) — do
+      # NOT ignore it; its alerts are real and actionable.