Wildcard Directories Causing Duplicates

This repository reproduces the issue described in dependabot/dependabot-core#13660.

Issue Description

When using wildcard directories (/** or **/*) in .github/dependabot.yml, Dependabot creates duplicate PRs for the same dependency update:

• One PR for the entire repo
• One PR for each individual directory

Structure

This minimal reproduction has:

1. .github/dependabot.yml - Configuration with wildcard directories for both github-actions and pip ecosystems
2. GitHub Actions workflows in nested directories:
   • .github/workflows/test.yml
   • service-a/.github/workflows/build.yml
   • service-b/.github/workflows/deploy.yml
3. Python requirements in nested directories:
   • requirements.txt
   • service-a/requirements.txt
   • service-b/requirements.txt

Expected Behavior

One PR per dependency update across all directories.

Actual Behavior

Multiple PRs for the same dependency - one for the root and one for each subdirectory.

Workaround

For Python dependencies, using just "/" as the directory (instead of wildcards) works because the pip handler checks nested directories. However, this doesn't work for github-actions.