Run Dependabot independently on each branch

[hugovk]

Rather than backporting Dependabot updates, which will pretty much always have conflicts due to different workflows, and which we often forget to do (causing more conflicts), let's have Dependabot run on each branch.

The config belongs in main, and unfortunately needs repeating, but each block is fairly small.

• https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#target-branch-
• https://docs.github.com/en/code-security/tutorials/secure-your-dependencies/customizing-dependabot-prs#targeting-pull-requests-against-a-non-default-branch

(Renovate would allow us to use a regex and avoid the repetition, but that's a bigger move involving installing a new app. But I'm a happy Renovate user in other projects, so it's always an option for later.)

[ezio-melotti]

It's unfortunate that there's no easy way to do it (unless target-branch: "3.*" works, but it's not documented).

This feature has been requested upstream before:

• dependabot/dependabot-core#2159

Here is the relevant documentation: https://docs.github.com/en/code-security/tutorials/secure-your-dependencies/customizing-dependabot-prs#targeting-pull-requests-against-a-non-default-branch

Also note this:

Dependabot raises pull requests for security updates against the default branch only. If you use target-branch, then as a result, all configuration settings for that package manager will then only apply to version updates, and not security updates.

[ezio-melotti]

I would move this to the top, so that all the main sections are together. Perhaps it should also be duplicated for all branches.

[hugovk]

Duplicated for bugfix branches only: updating mypy for security branches may need code changes which we don't want to do for security. Hypothesis is the other pip thing, which I'm not sure needs regular updates for security either. We can do manual backports if something is needed?

Moved to the top, so we have:

• GHA main
• pip main
• GHA bugfix+security
• pip bugfix

I also added grouping for pip updates, so we get a single PR per branch instead of several per branch.

[hugovk]

It's unfortunate that there's no easy way to do it (unless target-branch: "3.*" works, but it's not documented).

Yeah. If this becomes a pain, we can switch to Renovate and replace the repetition with a regex.

Also note this:

Dependabot raises pull requests for security updates against the default branch only. If you use target-branch, then as a result, all configuration settings for that package manager will then only apply to version updates, and not security updates.

Good to know. So we might need to do our own backports of those.

[hugovk]

This worked :)

• [3.15] build(deps): bump the actions group with 13 updates #158391
• [3.14] build(deps): bump the actions group with 13 updates #158390
• [3.13] build(deps): bump the actions group with 13 updates #158392
• [3.11] build(deps): bump the actions group with 11 updates #158386
• [3.10] build(deps): bump the actions group with 6 updates #158384

We do need to edit the titles to prefix [3.15] and so on, but much easier than manually backporting and fixing conflicts.

And because it's a fresh update, Dependabot updates all files, which are easier to miss when manually backporting. Plus the title counts are accurate. Compare:

• [3.14] build(deps): bump the actions group with 12 updates (GH-158342) #158356 - 22 files
• [3.14] build(deps): bump the actions group with 13 updates #158390 - 24 files