Keep GitHub actions dependencies up to date

[johnboyes]

• Look at both GitHub Dependabot and Renovate

• dependency PRs should be labelled with:

  • dependencies
  • patch

Dependencies to keep up to date:

• default Hoverfly version in the action.yml
• example Hoverfly version in the README
• shellcheck version in the devcontainer Dockerfile
• other dependencies in the devcontainer Dockerfile
• all the versions in my actions (in the .github/workflows dir)
• the go version in github_tag_and_release.yml
• the (latest) hoverfly version in the tests.yml
• the version of Ubuntu in the GitHub Actions
• the Docker image in the FROM command

[johnboyes]

Having looked into it Dependabot is the way to go:

• primarily because it's owned by GitHub.
• Thoughtworks recommend Dependabot
• Dependabot now keeps GitHub Actions up to date automatically - blog article, documentation
• New features appearing regularly, like automatic version updates - blog article, documentation

[johnboyes]

There is also depup, which could be worth looking into if Dependabot doesn't do everything for us out of the box.

[johnboyes]

Dependabot doesn't yet update references to Docker Containers in GitHub Actions, which is why the Label Checker version isn't being updated.

Dependabot will update references in a workflow file that look like uses: actions/setup-node@v1.0.0. In future it will also update references to Docker containers.

[johnboyes]

Have pinned the linux dependencies in the devcontainer Dockerfile, but there is no mechanism in place to automatically update them at this moment. Looks like it's on Dependabot's roadmap, so I've created a recurring reminder every 6 months to see if Dependabot offer it.

[johnboyes]

Ubuntu releases every year in April. In 2020 the GitHub Actions team offered the latest version by mid June, so I have created an annual reminder for 1st July each year to see if we can upgrade. Will involve e.g. for 2021, simply replacing ubuntu-20.04 with ubuntu-21.04 in every repo I have that uses GitHub Actions

[johnboyes]

Did all of this incrementally in a number of PRs, final one was #50