dependabot trial

[techknowlogick]

I know we have renovate (and we should use that long term), but I'm interested in seeing what dependabot will provide.

I've grouped all the ecosystem types into one PR per ecosystem so as not to overwhelm the PR page.

[silverwind]

npm dependencies @primer/octicons and material-icon-theme require make svg && git add --all to be executed after updating them. Also, go dependencies need make tidy to regenerate the license json.

I don't suppose these bots can such things?

[silverwind]

Maybe it needs something like https://github.com/orgs/community/discussions/48498#discussioncomment-5159337.

[silverwind]

We could potentially move all generation to build time as dependency of the frontend target, but that would likely add 30s+ time to the build and break use cases like:

• node/npm-less offline build from a tarball (I'd drop support for this)
• offline build in general because the go-licenses tool need to be fetched (maybe we should add a dedicted OFFLINE_BUILD variable to skip this step.

[techknowlogick]

@silverwind ah yes. I'd rather not have it be a build step (at least not be a part of this PR), since this is just to see what dependabot is like, so I've just removed npmdep management from this PR.

[silverwind]

It also affect go deps because of the license build, so sadly we need to either move the license build to a build-time dependency or try dependabot/dependabot-core#5962 (comment) or https://github.com/orgs/community/discussions/48498#discussioncomment-5159337.

[silverwind]

Other option may be to remove the license build completely, I never was a big fan of it 😉.