Added: Dependabot.yml config

[GoliathLabs]

What does this PR do?

This PR adds dependabot. Dependabot will take care of package updates (e.g. go.mod dependency updates, Dockerfile image tag updates and the gh actions used).

Why is it needed?

I think it's quite useful because @42wim doesn't really need to keep an eye on go/docker/gh-actions updates anymore, since Dependabot will create monthly PRs about the new updates of the used components. This will improve the security of the project as dependencies with security holes can be patched quickly.

I would really appreciate feedback on this PR 😄

[42wim]

Thanks! 2 questions

• could you make sure the gomod also does the vendoring?
• what exactly does the docker dependabot do ? base image security checks?

[GoliathLabs]

Thank you for the answer. Dependabot takes care of the vendoring as well (https://github.blog/changelog/2020-10-19-dependabot-go-mod-tidy-and-vendor-support/)

The docker dependabot checks whether a new version of the docker image is released (e.g. a new tag from 1.10.2 to 1.11).

[GoliathLabs]

In the meantime, why are we using the matterbridge forks of e.g. Rocket.Chat.SDK, they are just behind the upstream master and I don't see any commits in there that would make using them useful?

[42wim]

In the meantime, why are we using the matterbridge forks of e.g. Rocket.Chat.SDK, they are just behind the upstream master and I don't see any commits in there that would make using them useful?

Did you take a good look? :)

https://github.com/matterbridge/Rocket.Chat.Go.SDK/pulls?q=is%3Apr+is%3Aclosed

[42wim]

Please keep the schedule on monthly or at max weekly, I don't want to get daily PRs about dependencies that are not critical

[codeclimate]

Code Climate has analyzed commit 6f51c48 and detected 0 issues on this pull request.

View more on Code Climate.

[GoliathLabs]

In the meantime, why are we using the matterbridge forks of e.g. Rocket.Chat.SDK, they are just behind the upstream master and I don't see any commits in there that would make using them useful?

Did you take a good look? :)

https://github.com/matterbridge/Rocket.Chat.Go.SDK/pulls?q=is%3Apr+is%3Aclosed

Sorry, I think I did overlook those. 😅

Please keep the schedule on monthly or at max weekly, I don't want to get daily PRs about dependencies that are not critical

I've updated the interval

[42wim]

Thanks!