add dependabot config to update polkadot

[ordian]

No description provided.

[bkchr]

I'm against this. This will not solve any of the problems we have.

[ordian]

It should help until we fix the cumulus companion check (I agree it's not a proper solution to this problem) and also I don't see a harm in this.

[bkchr]

Not really harm, just spam of the bot :P

[ordian]

Not really harm, just spam of the bot :P

Once a day at most I think, but can also lower this.

[chevdor]

One issue I see with dependabot is that it keeps creating lots of noises as it opens PRs. Often those PRs sit here for more than one day.

It would be more efficient and less annoying to set a lower frequency such as weekly. It helps processing all those PRs at once and not have a new one showing up just after you dealt with all the open ones :)

I am however not certain it bring benefit over one person doing a round of updates "manually" and doing a single PR as required.

[ordian]

Note that this PR is only for one dependency (polkadot-primitives), which should update polkadot and substrate similar to #809.
My understanding is that it would be at most 1 PR per day, I can lower this to 1 PR per week, but the intention is to help with cumulus companion check for now.
Currently, many PRs are blocked on cumulus companion check just because of outdated Cargo.lock.

[drahnr]

This would indeed help the polkadot repo quite a bit, right now ~30 to 40% of our PRs don't work with bot merge due cumulus check failing.

[ordian]

closing in favor of paritytech/polkadot#4451