Add Github action to auto merge dependabot and pyup security updates if all tests pass.

[arnav13081994]

Description

What are you proposing? How should it be implemented?

I propose to add a new GitHub action or job that will auto merge pull requests from the pyup bot and the dependabot should the PR so created has no merge conflicts with master and all tests also pass.

This will be very similar to how pre-commit tool versions in the repo root are kept up to date.

Rationale

Why should this feature be implemented?

This would make updating requirements easier and more automated and would likely also make the project more secure. The tests are used to make the decision to merge updates from dependabot and pyup right now anyway.

[browniebroke]

I didn't know we could do that with Github actions. That sounds interesting!

I sometimes tested some updates for libraries which are production only, but I do this less often these days.

[arnav13081994]

I can always make it so that it runs only on requirements in 'requirements/local.txt' but then not sure how useful would automated security updates etc would be. Let me know what works best.

[Andrew-Chen-Wang]

@browniebroke You can just go into GitHub marketplace and add dependabot-preview. Then you can select the repo, select which requirements files you want, choose the labels you want, and it'll auto update, just like how pyup does it. You can see the outcome here where dependabot just litters my repo with updates to botocore and boto3 lmao.

You can find more info on configuring the auto merge here: https://dependabot.com/docs/config-file/#automerged_updates

If I'm not wrong, since GitHub bought dependabot, I think you don't even need to register in dependabot. You can just create their .dependabot.yaml file... somewhere... I can't remember.

[browniebroke]

As I mentioned in the pull request, dependabot is out of scope of this IMO, as it doesn't work well with cookiecutter templated files. Dependabot preview is the old version, before Github integrated it. The native Dependabot doesn't need to be enabled, uses a different config file and is part of GitHub docs.

[Andrew-Chen-Wang]

I think this issue can be closed with the comments from #2872