[Prototype] Generating grouped update PRs

[brrygrdn]

⚠️ This is an experimental spike ⚠️

The purpose of this is spike is to create an isolated code line to reimplement Dependabot::Update#run without taking on the need to verify our prototype work as strictly as the production implementation.

It is important to fail-fast on our proposed strategy and test our service's assumptions about PRs without investing more time in refactoring the existing code to make way for a new architecture that we can't be sure will actually work out.

This should not be considered indicative of the final architecture

The Approach

This spike explores grouping in a naive, ecosystem-agnostic way by using the Dependabot::Updater class to drive collecting up the Dependency changes required by a particular group rule - for now we assume a rule of '*', i.e. group everything - and then executing a single FileUpdater and PR creation invocation on the aggregate changes.

For purposes of simplicity, we have disabled concerns around managing the lifecycle of PRs, i.e. superseding and rebasing existing PR, as well as set aside Security-only update strategies since they are already special-cased.

Goals

1. Flush out general refactors required in the updater/ code to improve quality, test coverage, etc
2. Determine architectural changes required to Dependabot::Updater to better isolate the UpdateChecker and FileUpdater steps to break the assumption they are always 1:1
3. Provide a walking skeleton we can attach further experiments within common/lib to in order to test our hypothesis without waiting on (1) and (2) to ship

Non-goals

1. Write production quality-code
   • This is a highly experimental spike, if we do eventually merge it for continued testing it will remain behind an experiment flag and remain isolated in such a way it cannot impact existing code.
   • This should also be considered a throw-away prototype, so using this in our own scripts is highly discouraged and will not be supported.
2. Address the dry-run script
   • basic first pass at creating a grouped PR #5867 spikes out this strategy in the dry-run script as part of an earlier experiment
   • We might further the basic first pass at creating a grouped PR #5867 spike to do some more exploration, but it should be considered a feed-in to this work which will take priority
   • Once we have settled the Dependabot::Updater architecture we will figure out how to best maintain the dry-run script as the two overlap heavily

[brrygrdn]

This passes existing tests but is too naive to work under most circumstances, this is where we need to replicate the iterative file changes from the dry-run prototype.

@bdragon I think this is essentially where the control plane for the underlying file system would be, with generate_dependency_files_for being executed per row of update_batch.values and the outcome resulting in either a git commit or git clean.

[brrygrdn]

As noted, this test is a fork of the existing tests as just acts as a plumb-line for how much coverage we have on the new code, what is currently side-stepped, etc as a way to heatmap where we need to bring up coverage before we start changing the 'real' implementation.

[landongrindheim]

Approving to unblock image building workflows 🔓

[brrygrdn]

Closing this out as superseded by #6884