ci: Add dependabot

[SKY-ALIN]

Dependabot will make PRs to update dependencies weekly, it helps keep dependencies up to date. You don't need to add something to the repository's settings or this PR, it'll start to work after the merge.

GitHub page about it

An article about it on Medium

[coveralls]

coverage: 85.218%. remained the same when pulling 331ba7e on SKY-ALIN:master into 29cf0f5 on rust-bio:master.

[dlaehnemann]

Thanks for suggesting this. Looks pretty straightforward to me!

[dlaehnemann]

Ah, one second. I'd probably move this alongside the other CI workflows into the .github/workflows/ directory. Other than that, this is good to go.

[SKY-ALIN]

I suppose it's not possible because it must be stored exactly in the .github folder:

You must store this file in the .github directory of your repository. When you add or update the dependabot.yml file, this triggers an immediate check for version updates.

Source: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#about-the-dependabotyml-file

[dlaehnemann]

Are you sure that subdirectories won't work? Should we try?

[SKY-ALIN]

I'm not sure, let's try

[dcroote]

Looks like everyone puts in .github and not the workflows subdirectory.

[dlaehnemann]

But it does seem to work in sub-directories as well. @SKY-ALIN was so gracious as to try it out in the rust-bio-types repo:
rust-bio/rust-bio-types#48

[dlaehnemann]

Would you nevertheless argue to keep it in the main .github/ folder, because that's the convention, @dcroote ?

[SKY-ALIN]

Let's check how it works in the rust-bio-types repo. If we don't receive new PRs from Dependabot in a week, just move it back

[dlaehnemann]

Yes, let's do that. And feel free to ping me in again, once you check!

[dcroote]

I lean towards convention, but no strong preference myself. Waiting on the other repo and if it works, leaving it in the subdirectory sounds like a plan.

[SKY-ALIN]

Finally, it doesn't work like that. We have to move it back to .github folder

[dcroote]

Thanks for following up on this

Dismissing in order to merge given we've arrived at our answer of where the file needs to be

[dlaehnemann]

Also, I realized we need to add a conventional commit prefix to the commit messages, to make the respective check pass. The suggested fix is in PR #542 (for future reference, if any of us introduce the dependabot elsewhere...).