Proposal: Use dependabot to keep up to date with dependencies

[HonkingGoose]

Hi all from the Pro Git 2 team.

I noticed that @aollier is busy updating the Ruby gems manually (#1347). Now this is good, but we can also partly automate this work.

Using Dependabot will make keeping track of dependencies a lot easier.
To demonstrate how this might work for you, I've already set up Dependabot on my fork, so that you can look at it:

The pull-request that Dependabot makes can be viewed here:
https://github.com/HonkingGoose/progit2/pulls

The configuration that I used to get this working can be viewed here:
https://github.com/HonkingGoose/progit2/tree/dependabot_setup/.dependabot

The way it works is:

1. Dependabot scans if there are outdated packages on a daily basis.
2. When Dependabot finds outdated packages, it will open a pull request.
3. The "reviewer" then manually checks out the branch that Dependabot has made, and runs the tests, and manually verifies things are okay.
4. The "reviewer" then rebases the dependabot update on top of master.
5. Done.

I would be more than happy to help you guys get set up.
If using Dependabot is something that you would like, I will make a pull-request that's tailored to your requirements.

Greetings,

HonkingGoose

[ben]

Absolutely. Would it just be a PR, or is there some other configuration I need to enable?

[HonkingGoose]

It would be both a PR and some configuration work.

---

PR

I'll go make a PR that includes a basic config file. 😄 That will serve as a starting point, and we'll refine it together to be just-right.

---

Config work:

You (or the ultimate owner of the repository) will need to:

1. Sign-up with Dependabot, click the blue button sign-up. You do not need to make a new account for Dependabot, it uses the GitHub credentials.
2. Give Dependabot access to the ProGit2 repo, from the Dependabot dashboard.
3. Merge the above mentioned pull-request when happy with the config file.
4. Check if Dependabot works by clicking "Bump now" in the Dependabot dashboard, I think it will complain if something is not right.

[HonkingGoose]

See: #1353 for the pull-request.