Add a Dependabot config to maintain GitHub action versions

[kurtmckee]

If accepted, Dependabot will scan the repo for GitHub action version updates once per month and submit a single PR for any actions that have received updates.

Since the repo only pins to major versions (like actions/checkout@v4), this will probably be a small number of PRs per year. Nevertheless, it will help reduce maintenance burden as actions are updated and old versions are deprecated.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 85.63%. Comparing base (686db86) to head (2a02700).
Report is 2 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #376   +/-   ##
=======================================
  Coverage   85.63%   85.63%           
=======================================
  Files          20       20           
  Lines         696      696           
=======================================
  Hits          596      596           
  Misses        100      100           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[anishathalye]

We pin major versions; would Dependabot submit a PR to bump a major version? How exactly does that work, since actions' APIs can change with major version upgrades? I couldn't answer this question based on the docs I could find [1, 2].

[kurtmckee]

Dependabot simply updates the version. In some cases (actions/checkout, actions/setup-python) there haven't been any breaking changes when they upgraded across major versions.

The only time I've seen breakage in the last several years (for the actions I've used) was for caching and artifact actions changes. Importantly, the old versions were being shut down completely and would stop working. Therefore, having Dependabot submit a PR flagging that a new version was available, and seeing the CI job fail in the PR, indicated not only that there was a new version, but triggered investigation to see what was happening.

In effect, the PRs for actions/cache and actions/{upload|download}-artifact served as notifications that the versions I was using were going to be shutdown if I did nothing.

[anishathalye]

Sounds good!