[Internal][deps] Idea: look at a fancier tool than Dependabot for dependency updates

[AnnaKornfeldSimpson]

There are fancier tools than Dependabot for dependency updates which support some of the features that would be really helpful for Tasks, such as grouping dependencies and automerge on groups.

One free example is "Renovate", which is set up as an app in the GitHub Marketplace and can be applied to specific repositories upon install. I ran into it when I was trying to figure out an issue with jest-related dependency updates, so this is purely an example, not a recommendation resulting from a comprehensive search.

• Renovate Documentation - the Configuration and "Included Presets" sections will probably be the most relevant.
• A blogpost on Renovate with example setup - some of the config snippets in here do not match what we want but this gives a sense of the tool and overall configuration process and helped me understand the documentation.
• An important config option for Tasks is :preserveSemverRanges, so at the very least during the onboarding PR the config file should be changed to add that:

  "extends": [
    "config:base",
    ":preserveSemverRanges"
  ]

• config:base already helps by grouping jest and eslint related updates. It also looks like it can handle the dependencies in the docs Docker+Ruby+bundle mess better than dependabot.
• I cannot tell the default frequency of update checks are but I would recommend disabling the per-hour PR rate limit that comes with config:base.
• The Renovate documentation concept page on automerge was useful to me. However I do not agree at all about lockFileMaintenance being low risk; that will change dependencies that we would smoke test! The linting example just below (and copied here) makes much more sense to me.

  "packageRules": [
  {
    "matchDepTypes": ["devDependencies"],
    "matchPackagePatterns": ["lint", "prettier"],
    "automerge": true
  }
  ]

• The automerge documentation page also discusses adding an auto-approver for GitHub since PRs on the Tasks repo require reviews.
• Something that needs additional docs reading would be how lock files are handled and whether any default configuration options need to be changed on those.

Hope this helps!
Related: #1086

[claremacrae]

Wow, this is amazing, thank you @AnnaKornfeldSimpson !