Enable Dependabot for Cargo and GitHub Actions

[lafrenierejm]

No description provided.

[lafrenierejm]

@sirwart Friendly bump!

[sirwart]

Thanks @lafrenierejm, I'm not super familiar with dependabot, but could you make it so it will only suggest dependency updates when an existing dependency has a security vulnerability? In general I subscribe to the "if it aint broke" philosophy on this.

[lafrenierejm]

Sure! I'll update my branch shortly to only raise for security vulnerabilities.

[lafrenierejm]

@sirwart I have updated this PR to limit Dependabot's Cargo PRs to security fixes only. Copying the body of the commit message here:

From https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file:

Dependabot default behavior:

• If five pull requests with version updates are open, no further pull requests are raised until some of those open requests are merged or closed.
• Security updates have a separate, internal limit of ten open pull requests which cannot be changed.

When open-pull-requests-limit is defined:

• Dependabot opens pull requests up to the defined integer value.
• You can temporarily disable version updates for a package manager by setting this option to zero…

I deliberately left non-security updates enabled for GitHub Actions. My rationale:

1. Not updating Actions will eventually result in outright broken pipelines due to GitHub making changes to the underlying ubuntu-latest image (e.g. removing a deprecated version of Node that an old Action might rely on). Such updates aren't guaranteed to be reported as security fixes.
2. A "bad" Actions update is quite unlikely to result in unwanted changes to ripsecrets itself. Much more likely is that the CI and/or release pipelines would outright fail.

If you would prefer to be more conservative even for GitHub Actions updates, just LMK; I'm glad to restrict those PRs to security fixes only if needed.

[sirwart]

Thanks, we'll give this a try and see how it goes!