From dfd201b3f9850706f94ff51bc07a5615404f94b9 Mon Sep 17 00:00:00 2001
From: Zack Whitson <zwhitson01@gmail.com>
Date: Wed, 15 Jul 2026 13:34:21 -0500
Subject: [PATCH] Keep scanner upgrades manually reviewed

---
 .github/dependabot.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ca79ca5..4b0f1bd 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,3 +4,7 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    # The HOL action wraps a separately reviewed scanner wheel. Upgrade it only
+    # with the workflow comment, validator pin, wheel hash, provenance, and A/B report.
+    ignore:
+      - dependency-name: hashgraph-online/ai-plugin-scanner-action