Automate updating of vendored dependencies using Github Action

[evansd]

This should be possible using something like: https://github.com/marketplace/actions/create-pull-request

We'd want this to run as a scheduled job (once every few hours is probably enough) and also be able to run it manually using workflow_dispatch.

It would "just" be a case of checking out master, running ./scripts/update-dependencies.sh and then creating a PR if there are any changes.

[StevenMaude]

Are we generally happy using third-party actions? The alternative is to script the pull request creation by hand, which is also possible.

Do we mind manually closing and re-opening a PR to trigger any other workflows? The next best alternative is probably to create a GitHub App which trigger the workflows; separate machine account is also possible. Full options listed here.

[sebbacon]

Are we generally happy using third-party actions?

Not against them in principle for this repo; but we should select them carefully as have been tripped up in the past by poor implementations.

Do we mind manually closing and re-opening a PR to trigger any other workflows?

These days, you can trigger actions manually, too... that's what workflow_dispatch is - or do you mean something else?

[evansd]

@sebbacon I think Steven's referring to this annoying (but understandable) feature of Github Actions:

Pull requests created by the action using the default GITHUB_TOKEN cannot trigger other workflows. If you have on: pull_request or on: push workflows acting as checks on pull requests, they will not run.

So if this repo creates pull requests on itself then by default it won't run any of the tests. Closing and re-opening is a workaround for this.