Add dependency auditing to AWBW

[lenikadali]

• This work is part of Add dependency audits to AWBW #75

What is the goal of this PR and why is this important?

Adding dependency auditing using GitHub's dependabot

How did you approach the change?

Looked at the Homeward Tails implementation here and the Dependabot documentation here with the interval initially set to weekly to test the workflow. If we are comfortable with a more frequent upgrade schedule, the configuration can be changed to daily.

Anything else to add?

Maybe we want to use renovate? My impression is that is meant for non-GitHub repositories (e.g. it would be useful if we were on GitLab or Codeberg) but happy to use that if it fits 😊

P.S: We can merge and do a test run. If it doesn't work the way we would like, then we can revert the change and/or push up a fix for the workflow.

[elasticspoon]

I left this comment on the issue but ill duplicate it here:

This is great! Dependabot is probably the best approach but I would say this should wait until we get the app to rails 8. So many of the dependencies are out of date that if dependabot starts opening PR it's gonna create a crazy amount of noise.

Some other notes too:

• once a week sounds great.
• I think we should group the patch and minor versions together to open fewer PRs

[maebeale]

I left this comment on the issue but ill duplicate it here:

This is great! Dependabot is probably the best approach but I would say this should wait until we get the app to rails 8. So many of the dependencies are out of date that if dependabot starts opening PR it's gonna create a crazy amount of noise.

Some other notes too:

• once a week sounds great.
• I think we should group the patch and minor versions together to open fewer PRs

fwiw, I agree with @elasticspoon re waiting until we've done some more of the upgrade work. AND, very excited to get this added to this project -- thanks, @lenikadali!

[lenikadali]

I think we should group the patch and minor versions together to open fewer PRs

Makes sense. Will add 👌

this should wait until we get the app to rails 8.

No worries 😎 I think we can discuss this in the Upgrade and Stuff to Do #3 issue

[johnpaulashenfelter]

Partially handled in #110. Can add Rails after upgrades are over to reduce the noise.

[lenikadali]

Partially handled in #110. Can add Rails after upgrades are over to reduce the noise.

Nice! 😇 In which workflow should I put the TODO for this? I thought maybe the sanity-check workflow but wasn't sure.

I think we should group the patch and minor versions together to open fewer PRs

@elasticspoon for now, I think I will put a TODO in the dependabot workflow so that it doesn't get forgotten but not sure how grouping will fit with the current structure of the workflows. Probably for a follow-up PR so that this one doesn't get too long to review ☺️

[maebeale]

Agree we can start weekly and go from there. Thanks for getting this into the project, @lenikadali !