From 813b7199519b23fb47d8c71f5b2f6c33853b8af0 Mon Sep 17 00:00:00 2001
From: Dhruv Patel <dpatel@alcion.ai>
Date: Mon, 31 Oct 2022 09:55:35 -0400
Subject: [PATCH] add dependabot support for npm and go dependencies (#1347)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Description

Adds dependabot support to `corso/src` (go).
Adds dependabot support to `corso/website` (npm).
Adds dependabot support to `corso/docs` (npm).

Adds dependabot support to `corso` for actions as well.

Warning that dependabot emails can get noisy so everyone may need to add
email rules/update repository notifications 😭

~PR limit of `5` here to test and we can increase as needed.~ Working
well in `ark`. Increased to 50 w/ auto-merge.

## Type of change

Please check the type of change your PR introduces:
- [ ] :sunflower: Feature
- [ ] :bug: Bugfix
- [ ] :world_map: Documentation
- [ ] :robot: Test
- [ ] :hamster: Trivial/Minor
- [x] :moneybag: Tech Debt

## Linear Issue(s)
<!-- use one of the following "magic words" - "closes, fixes" to link to
the Linear issue. Can reference multiple issues-->

- Fixes ALC-541

## Test Plan
Merge and see what happens (no way to currently test dependabot config).

<!-- How will this be tested prior to merging.-->

- [ ] :muscle: Manual
- [ ] :zap: Unit test
- [ ] :green_heart: E2E
- [x] :x: TEST IN PROD 👀
---
 .github/actions/auto-merge.yml | 15 +++++++++++++
 .github/auto-merge.yml         |  4 ++++
 .github/dependabot.yml         | 39 ++++++++++++++++++++++++++++++++++
 3 files changed, 58 insertions(+)
 create mode 100644 .github/actions/auto-merge.yml
 create mode 100644 .github/auto-merge.yml
 create mode 100644 .github/dependabot.yml

diff --git a/.github/actions/auto-merge.yml b/.github/actions/auto-merge.yml
new file mode 100644
index 000000000..d6c4fd19d
--- /dev/null
+++ b/.github/actions/auto-merge.yml
@@ -0,0 +1,15 @@
+name: auto-merge
+
+on:
+  pull_request:
+    paths-ignore:
+      - "src/**" # prevent auto-merge for go dependencies
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: ahmadnassri/action-dependabot-auto-merge@v2 # https://github.com/marketplace/actions/dependabot-auto-merge
+        with:
+          github-token: ${{ secrets.DEPENDABOT_TOKEN }}
diff --git a/.github/auto-merge.yml b/.github/auto-merge.yml
new file mode 100644
index 000000000..16c282ba1
--- /dev/null
+++ b/.github/auto-merge.yml
@@ -0,0 +1,4 @@
+# auto-merge config file (see https://github.com/marketplace/actions/dependabot-auto-merge#configuration-file-syntax)
+- match:
+    dependency_type: all
+    update_type: "semver:minor" # includes patch updates!
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..70c70e6c3
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,39 @@
+# See: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    reviewers:
+      - "corso-maintainers"
+    open-pull-requests-limit: 50
+
+  # Maintain dependencies for npm - website
+  - package-ecosystem: "npm"
+    directory: "website/"
+    schedule:
+      interval: "daily"
+    reviewers:
+      - "corso-maintainers"
+    open-pull-requests-limit: 50
+
+  # Maintain dependencies for npm - docs
+  - package-ecosystem: "npm"
+    directory: "docs/"
+    schedule:
+      interval: "daily"
+    reviewers:
+      - "corso-maintainers"
+    open-pull-requests-limit: 50
+
+  # Maintain dependencies for go - src
+  - package-ecosystem: "gomod"
+    directory: "src/"
+    schedule:
+      interval: "daily"
+    reviewers:
+      - "corso-maintainers"
+    open-pull-requests-limit: 50