Sl/chore/can 7656/can 7679

.github/dependabot.yml

@@ -1,10 +1,37 @@
+# file is synced from cove-workflow
+
 version: 2
+registries:
+  npm-npmjs:
+    type: npm-registry
+    url: https://registry.npmjs.org
+    token: ${{ secrets.NPM_TOKEN_READ_ONLY }}
 updates:
-  - package-ecosystem: "npm"
+  - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
-  - package-ecosystem: "github-actions"
+      interval: "weekly"
+    commit-message:
+      prefix: chore
+      prefix-development: chore
+    groups:
+      all:
+        update-types:
+          - "major"
+          - "minor"
+          - "patch"
+  - package-ecosystem: "npm"
     directory: "/"
+    registries:
+      - npm-npmjs
     schedule:
-      interval: "daily"
+      interval: "weekly"
+    commit-message:
+      prefix: chore
+      prefix-development: chore
+    groups:
+      dev-dependencies:
+        dependency-type: "development"
+        update-types:
+          - "minor"
+          - "patch"

.github/workflows/dependabot-new-pr.yml

@@ -0,0 +1,63 @@
+name: Dependabot New PR
+on:
+  pull_request:
+    types:
+     - opened
+     - reopened
+jobs:
+  dependabot:
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - uses: actions/checkout@v4
+      - name: read maintainers.json
+        id: read-maintainers
+        # reads maintainers array and map them to their slack userIds "mentions" (see slack api https://api.slack.com/reference/surfaces/formatting#mentioning-users)
+        run: |
+          # shellcheck disable=SC2002
+          echo "maintainers=$(cat maintainers.json | jq '.[] | to_entries | .[].value' | jq --slurp -r '. | join(" ")')" >> "$GITHUB_OUTPUT"
+      - name: 'Post PR to #dev-pr'
+        if: always() # continue even if read-maintainers failed for some reason
+        uses: slackapi/[email protected]
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+          MAINTAINERS: ${{ steps.read-maintainers.outputs.maintainers }}
+        with:
+          channel-id: C0399MY1YKW # dev-pr channel
+          payload: |
+            {
+               "attachments": [
+                    {
+                        "mrkdwn_in": ["text"],
+                        "color": "#3679a6",
+                        "author_name": "Dependabot 🤖",
+                        "author_icon": "https://manage.cove.is/imgs/favicon.png",
+                        "title": "${{ github.event.pull_request.title }}",
+                        "title_link": "${{ github.event.pull_request.html_url }}",
+                        "fields":
+                        [
+                            {
+                                "title": "repository",
+                                "value": "${{ github.event.pull_request.head.repo.name }} ",
+                                "short": false
+                            },
+                            {
+                                "title": "maintainers",
+                                "value": "${{ env.MAINTAINERS || 'no one' }}",
+                                "short": true
+                            }
+                        ],
+                        "thumb_url": "https://manage.cove.is/imgs/favicon.png",
+                    }
+                  ]
+            }
+  #############################################
+  notify-all:
+  #############################################
+      uses: livelyhood/cove-workflows/.github/workflows/notify.yml@main
+      needs:
+        - dependabot
+      if: ${{ always() && contains(needs.*.result, 'failure') }}
+      secrets: inherit
+      with:
+        failure: true