chore: add Dependabot configuration

[salmanmkc]

Fixes #207

Adds weekly dependency update checks for:

• Root npm dependencies
• Docs npm dependencies
• GitHub Actions versions

[dli7319]

Thanks

[dli7319]

Actually, I think we'll manage it manually since this causes dependabot to spam PRs.

[ruofeidu]

I agree, I think this is adding too many workloads for humans :(

[salmanmkc]

What about something like this? It enables setting open PR limits, etc. too so that the workload for humans can be more manageable @ruofeidu @dli7319

We can group and have them done monthly, also depending on the type of update and whether it's first party from actions vs third party actions. Example PRs it made are here: third party and first party

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "monthly"
    open-pull-requests-limit: 10
    groups:
      npm-all:
        patterns:
          - "*"

  - package-ecosystem: "npm"
    directory: "/docs"
    schedule:
      interval: "monthly"
    open-pull-requests-limit: 5
    groups:
      npm-docs-all:
        patterns:
          - "*"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "monthly"
    open-pull-requests-limit: 5
    groups:
      ci-actions:
        patterns:
          - "actions/*"
      third-party-actions:
        patterns:
          - "*"
        exclude-patterns:
          - "actions/*"

[dli7319]

I think we can just have the grouped github-actions one updated on a monthly basis.

For npm dependencies, we don't roll them up in our library so I don't feel it's worth automating it:

1. If a dependency has no breaking changes, then the update PR is just noise since it won't affect anything.
2. If a dependency has breaking changes (e.g. threejs), then we'll need to look into it manually anyways.

[salmanmkc]

I think we can just have the grouped github-actions one updated on a monthly basis.

For npm dependencies, we don't roll them up in our library so I don't feel it's worth automating it:

1. If a dependency has no breaking changes, then the update PR is just noise since it won't affect anything.
2. If a dependency has breaking changes (e.g. threejs), then we'll need to look into it manually anyways.

awesome, I did a pr including npm, but just forced pushed it to be monthly third party and first party action splits, sorry about the initial spam, didn't expect it would do that all so suddenly 😄