build: focus Dependabot on security updates (#1759)

* build: focus Dependabot on security updates

* build: limit PR validation to CFS restores

* build: keep Dependabot updates for GitHub Actions

* test: avoid flaky hover screenshot verification

* build: validate locked dependencies with npm ci

* test: align hover verification wording

* build: disable scripts during CFS validation

* test: edit single-file fixture inside main

Author: wenytang-ms

.azure-pipelines/ci.yml

@@ -16,6 +16,17 @@ trigger:
   branches:
     include:
       - main
+pr:
+  branches:
+    include:
+      - main
+  paths:
+    include:
+      - package.json
+      - package-lock.json
+      - .azure-pipelines/ci.yml
+      - .azure-pipelines/npm-cfs.yml
+      - .azure-pipelines/npm-cfs-variables.yml
 extends:
   template: v1/1ES.Unofficial.PipelineTemplate.yml@1esPipelines
   parameters:
@@ -33,8 +44,22 @@ extends:
     stages:
       - stage: Build
         jobs:
+          - job: CFSValidation
+            displayName: Validate dependencies from CFS
+            condition: eq(variables['Build.Reason'], 'PullRequest')
+            steps:
+              - checkout: self
+                fetchTags: false
+              - task: NodeTool@0
+                displayName: Use Node 20.x
+                inputs:
+                  versionSpec: 20.x
+              - template: /.azure-pipelines/npm-cfs.yml@self
+              - script: npm ci --ignore-scripts --no-audit --no-fund
+                displayName: Validate npm dependencies from CFS
           - job: Job_1
             displayName: Agent job 1
+            condition: ne(variables['Build.Reason'], 'PullRequest')
             templateContext:
               outputs:
                 - output: pipelineArtifact

.github/dependabot.yml

@@ -1,22 +1,5 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-
 version: 2
 updates:
-  - package-ecosystem: "npm" # See documentation for possible values
-    directory: "/" # Location of package manifests
-    schedule:
-      interval: "daily"
-    # CI restores packages from the Central Feed Service, which withholds
-    # upstream versions until they are roughly a week old (measured at ~6.8
-    # days; both the packument entry and the tarball return 404 before then).
-    # Dependabot's built-in cooldown is only 3 days, so bumps otherwise land in
-    # a window where the feed 404s and the build fails. 10 days leaves margin
-    # in case the feed's ingestion lag drifts.
-    cooldown:
-      default-days: 10
   - package-ecosystem: "github-actions"
     directory: "/"
     groups:

test-plans/java-go-to-super-implementation.yaml

@@ -65,9 +65,12 @@ steps:
   # being absent / not rendered as a clickable link).
   - id: "hover-greet"
     action: "hoverOnText greet"
-    verify: "A hover popup is open over the overriding greet() method and it contains a clickable 'Go to super implementation' link"
+    verify: "A hover popup is open over the overriding greet() method, ready for the following link action"
     waitBefore: 5
     timeout: 30
+    # The popup can still show "Loading..." when the screenshot is captured on
+    # macOS. The next step deterministically proves that the link is available.
+    skipLlmVerify: true
 
   # ── Click the hover link ──────────────────────────────────────
   # This is the regression assertion for #4438: the link must be a

test-plans/java-single-file.yaml

@@ -57,8 +57,8 @@ steps:
 
   # ── Step 4: Verify basic editing ────────────────────────────────
   - id: "goto-main"
-    action: "goToLine 6"
-    verify: "Cursor moved to main method"
+    action: "goToLine 5"
+    verify: "Cursor moved to the existing statement inside the main method"
 
   - id: "goto-end"
     action: "goToEndOfLine"