Add dependabot config.

[wlynch]

Changes

Enables dependabot for pipelines.

See
https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
for more details.

Signed-off-by: Billy Lynch [email protected]

/kind misc

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

• [n/a] Docs included if any changes are user facing
• [n/a] Tests included if any functionality added or changed
• Follows the commit message standard
• Meets the Tekton contributor standards (including
  functionality, content, code)
• Release notes block below has been filled in
  (if there are no user facing changes, use release note "NONE")

Release Notes

NONE

[wlynch]

cc @imjasonh @afrittoli

[wlynch]

/cc @imjasonh @afrittoli

[vdemeester]

@wlynch this is linked to tektoncd/plumbing#1028 right ?
One "tricky" thing about pipeline is that, we need to do "extra stuff" when we upgrade dependencies : (re)-generate code, …, maybe applying a temporary patch, … We might have to run our own "dependabot-like" way of upgrading dependencies instead of using dependabot direclty.

[wlynch]

One "tricky" thing about pipeline is that, we need to do "extra stuff" when we upgrade dependencies : (re)-generate code, …, maybe applying a temporary patch, … We might have to run our own "dependabot-like" way of upgrading dependencies instead of using dependabot direclty.

Yeah, though this probably won't make that any harder.

I think worst case we'll get a few PRs that won't pass unit tests (probably for anything k8s.io related), which will be a signal for additional intervention. Even if we can only use this with 80% of deps, it seems worthwhile to enable it. If this ends up being too noisy we can roll it back.

[vdemeester]

Yeah, though this probably won't make that any harder.

I think worst case we'll get a few PRs that won't pass unit tests (probably for anything k8s.io related), which will be a signal for additional intervention. Even if we can only use this with 80% of deps, it seems worthwhile to enable it. If this ends up being too noisy we can roll it back.

Fair enough 🙃

[vdemeester]

@wlynch I am trying this with tektoncd/cli, as you convinced me this could work 🙃. The only trick to it is the release-note block that will be missing, but, might be ok-ish

[imjasonh]

/test pull-tekton-pipeline-go-coverage

[imjasonh]

/lgtm

[vdemeester]

Should we put this to weekly ? I moved to weekly for hub just because with npm it was generating a lot of PR often.. but maybe we are fine here.

[vdemeester]

/meow
Let there be dragons 😓 🙃

[tekton-robot]

@vdemeester:

In response to this:

/meow
Let there be dragons 😓 🙃

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vdemeester

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [vdemeester]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[vdemeester]

/retest

[wlynch]

/test pull-tekton-pipeline-alpha-integration-tests

[afrittoli]

/test pull-pipeline-kind-k8s-v1-21-e2e