Enable dependabot for all packages.

[berndverst]

Description

Replaces stale PR #499 to enable Dependabot.

[berndverst]

Please take a look: @mukundansundar @halspang @artursouza

[halspang]

Looks good to me. I'm curious to see how often things will actually update after the first set.

[codecov]

Codecov Report

Merging #570 (1a8f7b3) into master (0e5e311) will decrease coverage by 0.13%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##             master     #570      +/-   ##
============================================
- Coverage     80.75%   80.61%   -0.14%     
+ Complexity      986      985       -1     
============================================
  Files            88       88              
  Lines          3039     3039              
  Branches        332      332              
============================================
- Hits           2454     2450       -4     
- Misses          419      422       +3     
- Partials        166      167       +1     

Impacted Files	Coverage Δ
sdk/src/main/java/io/dapr/utils/Retry.java	50.00% <0.00%> (-25.00%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0e5e311...1a8f7b3. Read the comment docs.

[berndverst]

@halspang apparently I need to pause this PR at the moment to update this for the requirements in #348:

@mukundansundar @artursouza

It seems we want:

• Dependabot making PRs into the dependabot branch (to be created)
• Tests to run in the dependabot branch and upon success to create a PR against the master branch.

The problem I see here is...
Doesn't this mean the dependabot branch needs to be synced against master regularly?

[halspang]

The problem I see here is...
Doesn't this mean the dependabot branch needs to be synced against master regularly?

Yes, but that could also be part of a workflow. Just merge master into it at some regular cadence. Or even as part of the workflow it could create, PR, merge, and then delete its own branch so it's fresh every time. That's what I'd go for personally but I think that relies on us being able to trigger dependabot instead of it going on its own cadence.

[berndverst]

Given that this PR was merged we will need to be careful not to approve every PR dependabot creates. This PR was never updated to use the special branch concept. However, doing so would also be unnecessarily complex and also error prone.