Enable Dependabot for GitHub Actions

[nineinchnick]

Description

Dependabot will automatically open pull requests to update GitHub Actions. The main benefit of this is knowing that new versions are available, especially if third-party GitHub Actions are pinned to specific versions. Running it weekly should give enough time to review updates, and also react swiftly to potential security updates.

Additional context and related issues

Release notes

(x) This is not user-visible or is docs only, and no release notes are required.
( ) Release notes are required. Please propose a release note for me.
( ) Release notes are required, with the following suggested text:

[findepi]

i'd like to have dependabot for normal dependencies even more than for actions.
That's because we don't ship action code, but we do ship the dependencies. Currently the whole burden is carried by @wendigo , but that feels unfair.

[nineinchnick]

I agree we should be using Dependabot instead of checking updates manually, but we need to configure it with access to secrets, so only an admin can do this.

[findepi]

I agree we should be using Dependabot instead of checking updates manually, but we need to configure it with access to secrets, so only an admin can do this.

@martint asked me this question -- Does dependabot understand the relationship between trino and airbase?

@nineinchnick do you maybe know?

[nineinchnick]

Does dependabot understand the relationship between trino and airbase?

You mean does it understand parent projects, or the usage of proeprties? Would it be better to discuss this on Slack? It's out of the scope of this PR.

[nineinchnick]

I've been using it in all my third-party Trino plugin repositories, check out this PR as an example: nineinchnick/trino-git#192

[mosabua]

I agree that this will be useful but I am also worried this is going to be noisy. Who is going to take on looking at all the PRs and evaluating them towards merge?

[wendigo]

@mosabua it's scheduled weekly so shouldn't bring too much noise

[mosabua]

@mosabua it's scheduled weekly so shouldn't bring too much noise

Lets hope so .. we can always tweak it as well. We might want to decide how we want to deal with the commit messages .. always squash and merge with rewording?

[wendigo]

@mosabua let's merge it and see the quality of PR and we can always revert

[mosabua]

Also note.. a bunch of this discussion is more about actual dependencies vs just the versions of the github actions .. but I am supportive of both..

[mosabua]

Agreed with @wendigo .. ship it.