Auto-approve Dependabot PRs

[peterbecich]

Template Β: This PR does not modify cabal behaviour (documentation, tests, refactoring, etc.)

Include the following checklist in your PR:

• Patches conform to the coding conventions.

Suggestion to auto-approve Dependabot PRs

Copied from:
https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#approve-a-pull-request

This works fine in hackage-server: haskell/hackage-server#1289

This will not auto-merge Dependabot PRs; that's documented here: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#enable-auto-merge-on-a-pull-request

[geekosaur]

This does not constitute administrative approval; I'd rather leave that to someone else.

[ulysses4ever]

As simple as it looks like on the surface, it's not entirely clear that we want to auto-approve all Dependabot suggestions. Consider discussion on #8807 for example

[Mikolaj]

Let's discuss more before we merge this.

[Kleidukos]

Any chance GHA definitions can exclude paths, like the requirements.txt?

[ffaf1]

I see some convenience in this, but there are risks (breaking stuff by auto mis-approvals, more stuff that breaks in CI). I don’t think the former is worth the latter.

[geekosaur]

For what it's worth, xmonad regularly sees CI breakage from dependabot updates because Haskell-CI hasn't caught up with it yet or because it's not compatible with older platforms we test on. (See for example xmonad/xmonad#491 (comment).)