chore: Add config for dependabot.

[liangyuanpeng]

Please briefly answer these questions:

• what problem are you trying to solve? (or if there's no problem, what's the motivation for this change?)

Let dependabot work for auto update github-actions to get rid of deprecated github actions.

Also can update it for argo if you accepts the automatic update of cargo dependencies,

  - package-ecosystem: "cargo"
    directory: "/"
    schedule:
      interval: "weekly"
    labels:
      - "dependencies"

• what changes does this pull request make?

• are there any non-obvious implications of these changes? (does it break compatibility with previous versions, etc)

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 74.40%. Comparing base (75e51f4) to head (d2229f5).
Report is 2 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #697      +/-   ##
==========================================
+ Coverage   74.38%   74.40%   +0.02%     
==========================================
  Files         173      173              
  Lines       25872    25872              
  Branches    25872    25872              
==========================================
+ Hits        19244    19250       +6     
+ Misses       5425     5420       -5     
+ Partials     1203     1202       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[Phoenix500526]

We can add open-pull-requests-limit for this workflow. 10 might be a reasonable value.

[Phoenix500526]

Why is github-actions rather than cargo?

[liangyuanpeng]

I just want to auto-update for github-action, so it will let the dependabot create a PR to work for like that:

-       uses: actions/checkout@v3
+       uses: actions/checkout@v4

If you also want cargo to automatically upgrade dependencies, I'd be happy to add the configuration.

[liangyuanpeng]

And i think the focus of xline at this stage is on the development of feature, so automatically updating cargo dependencies may not be that important.
No strong opinion from me.

[Phoenix500526]

IMO, automatically upgrade cargo dependencies is a good practice.

[liangyuanpeng]

@Phoenix500526
And just for confirm that you also want to schedule with daily for it?

[liangyuanpeng]

cc @bsbds ^^^

[liangyuanpeng]

My suggestion is to use monthly to reduce noise as much as possible at this stage if you want to enable aoto-update for cargo dependenices, and you can update it to weekly later.

[Phoenix500526]

Okay, you've convinced me. Daily might be too frequent; weekly is a better option.

[Phoenix500526]

LGTM