Create dependabot.yml

[3clypse]

Purpose

Add dependabot dependency check in order to maintain Go and Docker dependencies up-to-date and security updates on time.

https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates#enabling-or-disabling-dependabot-security-updates-for-an-individual-repository

Why

• A way to keep dependencies updates in single PR's that can be visible to anyone.
• Security patches could be applied quicker, given the bot will check for updates every day.

+ Info

• https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem
• https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates

[gotjosh]

I'm a big fan of dependabot and there seems to be precedent already for it in Prometheus -- I don't think this is something that should come from common (Prometheus has different directives it seems).

So in principle this LGTM.

[gotjosh]

Can you please remove the comments and set the interval of gomod to weekly?

[gotjosh]

Suggested change

# Look for Go modules in the `root` directory

[gotjosh]

Suggested change

# Enable version updates for go modules

[gotjosh]

Suggested change

# Check for updates every day (weekdays)

[gotjosh]

Suggested change

	interval: "daily"
	interval: "weekly"

[gotjosh]

Weekly seems like a better interval

[gotjosh]

Suggested change

	# Enable version updates for Docker
	- package-ecosystem: "docker"
	# Look for a `Dockerfile` in the `root` directory
	directory: "/"
	# Check for updates once a week
	schedule:
	interval: "weekly"
	- package-ecosystem: "docker"
	directory: "/"
	schedule:
	interval: "weekly"

[3clypse]

Can you please remove the comments and set the interval of gomod to weekly?

Done! Thank you for looking at this :)

[gotjosh]

LGTM.

@roidelapluie @simonpasquier what do you think?

[gotjosh]

Can you try re-pushing to your branch again to see if the CI triggers? I can't seem to find the CI run of this PR on CircleCI to try and let it run.

[3clypse]

Can you try re-pushing to your branch again to see if the CI triggers? I can't seem to find the CI run of this PR on CircleCI to try and let it run.

I bring the latest changes from prometheus/alertmanager

and re-commited my suggestion change.
Let me know if I can do something else.

Thank you.

[gotjosh]

Thanks!