ci(dependabot): add workflow to automatically update dependency guard when dependabot creates a PR

[rafaeltonholo]

Whenever @dependabot updates an Android version, the app will challenge the new version with the dependency guard, and the CI will fail.

This PR creates a workflow that, whenever @dependabot opens, reopens or updates a PR, this workflow will trigger and update the dependency guard if required.

[wmontwe]

LGTM

[coreycb]

I don't think the git push will work because the default permissions for actions on this repo don't allow write. I would hope those settings apply to PR branches as well. I think we should be reducing the "permissions:" of the GITHUB_TOKEN to at least read, and instead use actions/create-github-app-token.

[rafaeltonholo]

I don't think the git push will work because the default permissions for actions on this repo don't allow write. I would hope those settings apply to PR branches as well. I think we should be reducing the "permissions:" of the GITHUB_TOKEN to at least read, and instead use actions/create-github-app-token.

Since this only pushes to the pull request's branch, I don't think it will require any special permissions. I reviewed the documentation again and realized that I had missed adding the ref parameter to the action/checkout. This is likely going to cause an issue, as it checks out in detached HEAD mode.

Aside from that adjustment, I believe we should be able to commit and push without any issues. I don't think we need a custom token for this, as it still requires approval as part of the pull request process.

[coreycb]

I don't think the git push will work because the default permissions for actions on this repo don't allow write. I would hope those settings apply to PR branches as well. I think we should be reducing the "permissions:" of the GITHUB_TOKEN to at least read, and instead use actions/create-github-app-token.

Since this only pushes to the pull request's branch, I don't think it will require any special permissions. I reviewed the documentation again and realized that I had missed adding the ref parameter to the action/checkout. This is likely going to cause an issue, as it checks out in detached HEAD mode.

Aside from that adjustment, I believe we should be able to commit and push without any issues. I don't think we need a custom token for this, as it still requires approval as part of the pull request process.

I agree and the permissions should be reduced to read already based on the repo settings. LGTM