feat: enable dependabot

[ChristianTackeGSI]

Currently only for github actions

Example usage / "in action":

• FairRootGroup/FairCMakeModules@fadcfeb
  • Bump actions/checkout from 2 to 4 FairRootGroup/FairCMakeModules#34
• GSI-HPC/lustre_exporter@e3bb8bf
  • Bump docker/setup-buildx-action from 2 to 3 lustre_exporter#43

[mattkretz]

Thanks Christian. To keep with the existing style, there should probably be an addition to the README.md on how to use it in your own repo.

And then, I guess we should add documentation on

• if/when/why you want to use one of these actions
• where to find more information

But that doesn't need to be part of this PR.

[mattkretz]

Oh, and since I have no idea what dependabot does ;) can you tell me why it doesn't go into the workflows directory?

[ChristianTackeGSI]

There are lots of docs about dependabot here:
https://docs.github.com/en/code-security/dependabot

Basically it checks for updates of your dependencies and creates a Pull Request to update that dependency. I posted a few example PRs at the top to show how that looks like in the real world.

The dependabot config I added checks for updates of the actions in the Github workflows. This is quite important, as the actions (like checkout@v4) are still quite in flux and some even stop working (for example actions/[email protected], see: GSI-HPC/lustre_exporter#41).

Some other packaging "eco systems" are a bit more complex and involve more thinking. For example updating github.com/prometheus/client_golang in the golang universe raises the minimum required Go version beyond what we have on some of our machines.

[mattkretz]

Ah, so this PR isn't about providing another .yml for others to copy into their repo but to keep our template up to date?

[ChristianTackeGSI]

Both.

1. To keep our templates up to date
2. To update the workflows ("templates") after they have been copied over into another repo
3. To keep other wofkflows (not from this template repo) in other repos up to date.

[mattkretz]

I'll just merge and will open an issue about improving the README