ci(deps): configure dependabot for github-actions

[davorpa]

What does this PR do?

1. Dependabot checks for updates. Dependabot pulls down your dependency files and looks for any outdated or insecure requirements.
2. Dependabot opens pull requests. If any of your dependencies are out-of-date, Dependabot opens individual pull requests to update each one.
3. You review and merge. You check that your tests pass, scan the included changelog and release notes, then hit merge with confidence.

So, this PR configures Dependabot to automatize this process for github-actions artifacts used in repository workflows.

As is config provided needes add this labels to github repo/org:

free-programming-books/.github/dependabot.yml

Lines 17 to 22 in 786ae8b

	# Specify labels for `gha` pull requests
	labels:
	- "dependencies"
	- "dependencies:github-actions"
	- "automation"
	commit-message:

Checklist:

• Read our contributing guidelines
• Search for duplicates.
• Provide dependabot.yml config file.
• Choose labels and add them to repo or if config is centralized, do it in organization.
• Enable dependabot in repo settings

Followup

• Check the output of Travis-CI for linter errors!

[eshellman]

Would appreciate review from someone familiar with this.

[davorpa]

I'll know is a critical file of repo configuration, so I'll provide more info...

Dependabot aims to solve/fix security issues (something as is kwown as CVE - Common Vulnerabilities and Exposures) making automatic pull request as way of recomendations. At those PR, an entire context with breaking changes, release/changelog history compatibility and so on will be provided as description. In neither moment it commits nothing without supervision.

▶️ A guide reference of how to activate or change proposed configuration can be started here:

https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-version-updates

▶️ On activate before merge this, a non parametrized file is suggested to commit, and be sure that conficts will appear.

▶️ I avoid to set assignees / reviewers parameters due to I see is a feature not used in PR process of this repo. Also schedule could be changed (now is at Central Europe on half day of Saturdays, perfect to handle also America timezone), or labels...

Let me know what is expected, and I'll change it. 😉

▶️ About all config parameters can be used in dependabot.yml:

https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates

▶️ This below list there are the dependencies that will be monitorized in both workflows, fpb-lint and url-awesomebot, we have:

• actions/checkout
• actions/setup-node
• trilom/file-changes-action
• actions/upload-artifact

I hope this helps to get in context 🤗

[davorpa]

Today dependabot advice me about an action update

Here the example: davorpa/testing-github-actions#1

[davorpa]

Today again another notification about github-actions comes into my inbox.

It cheat me that setup-node action should be upgraded.

davorpa/testing-github-actions#3

[eshellman]

Question: on other repos I have, there's a bot that warns about security issues, but the alert and PRs are only visible to repo owner. Is that true for dependabot?

[davorpa]

Question: on other repos I have, there's a bot that warns about security issues, but the alert and PRs are only visible to repo owner. Is that true for dependabot?

PRs are always public. Security alerts don't.

Moreover, I don't know if bot only response to reply commands (e.g. @dependabot squash and merge) if you are a mantainer. I'd have to check it. Documentation don't tell us too much about.

@EbookFoundation/reviewers Could someone try with davorpa/testing-github-actions#2 that is still open?

[CleanMachine1]

just a small nitpick

[LuigiImVector]

Could someone try with davorpa/testing-github-actions#2 that is still open?

Only who have the permissions can: davorpa/testing-github-actions#2 (comment)

[davorpa]

Only who have the permissions can: davorpa/testing-github-actions#2 (comment)

Yep, I'll see it. thanks, Luigi.

Then I think it's safe enable this feature since is like a normal PR but with a bot commands and compatibility info as extra.