feat(dependabot): Add dependabot to check for vulnerabilies and updat…

[BLANKatGITHUB]

This will automatically scan for updates in dependencies and create pull request to merge them.

• Added daily update schedule for GitHub Actions workflows in the root directory.
• Added daily update schedule for Go modules in the /contrib/charts/dragonfly directory.
• Added daily update schedule for Python packages in the /tests/dragonfly directory.
• Added daily update schedule for Go modules in the /tools/replay directory.
• Added daily update schedule for Python packages in the /tools directory.

[romange]

let's group all directories for each package ecosystem together.
See https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#directories for more details.

[BLANKatGITHUB]

okay, well do you prefer daily checks, or should I make it weekly?

[romange]

Weekly is enough, thanks! 🙏🏼

[BLANKatGITHUB]

well I made adjustments , it will check for latest versions of dependencies , you will have to change the version of languages manually though for python and go . Dependabot makes pr for dependencies not language .

[romange]

Thanks!

[romange]

@BLANKatGITHUB dependabot start working but it is a bit noisy :)

I saw it is possible to group updates into a single update PR using groups:
https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#example-2

do you mind improving the file so that it will group the updates under a single dev-dependecies group?

[BLANKatGITHUB]

I will try.

[romange]

Also, worth limiting these updates to (security) patches only if possible. We do not always want to update to latest due to the distribution limitations.

[BLANKatGITHUB]

umm I dont understand? You want depandabot to create only security update prs?

[romange]

@BLANKatGITHUB please look at this PR for example:
#4061

it was opened with version that is not even present on distributions that we run on (ubuntu 20.04) see here:
https://github.com/dragonflydb/dragonfly/actions/runs/11672206748/job/32500305414

if we limit updates to patch updates only, hopefully this won't happen.

[BLANKatGITHUB]

So basically only security updates right?

[romange]

yes, if possible