Add Dependabot

[StefMa]

Pull Request (PR) Checklist

Please check if your pull request fulfills the following requirements:

• The PR is submitted to the main branch.
• I've read the Contribution Guidelines.
• The code builds and is tested on a real Android device.
• I confirm that I've run the code locally and everything works as expected.

Put an x in the boxes that apply.

• Demo: Checking checkbox using [x]

Upload a screen recording + screenshots to prove that your changes work.

Pull Request Type

Please check the type of the changes that your PR introduce:

• Bugfix
• Feature
• Code style update (formatting, new lines, etc.)
• Refactoring (no functional changes, renaming)
• Small improvement (fix typo, UI fine-tune or something small)
• Gradle Build related changes
• Dependencies update (updating libraries)
• Documentation (clarifying comments, KDoc)
• Tests (Unit, Integration, UI tests)
• Other (please describe):

Put an x in all the boxes that apply.

What's changed?

Describe with a few bullets what's new:

• Adds dependabot

💡 Tip: Attach screenshots and screen recordings. It helps a lot!

Does this PR closes any GitHub Issues?

Check Ivy Wallet Issues.

• Closes Add Dependabot for dependency updates  #2450

Replace {ISSUE_NUMBER} with the id/number of the issue that you've fixed.

Dev notes

After you merge this, it will check every Monday for dependency updates and creates pull request for them.

Currently this doesn't have any custom configuration. Like maybe only group update jetpack compose compiler and kotlin itself. Or how many PRs will be opened at the same time. However, I guess this can be done later when we have a bit more exoirience how many dependencies will be updated, how annoying this is and so on... Let's start with that and fine tune later 🙃

[ILIYANGERMANOV]

Excellent! I was hoping to automate dependencies versions management for a long time ago 👏

[ILIYANGERMANOV]

Hey @StefMa nice work 💯 How hard is to make dependabot group version bumps in one PR? It just opened 8 PRs at the same time 😀

[StefMa]

Shouldn't be that hard. But actually I don't now much about the project and their dependencies. So I don't know which dependencies belongs together and therefore need to be updated together.
As far as I can see it, most of those 8 PRs are independent and a group wouldn't help here...

[ILIYANGERMANOV]

Shouldn't be that hard. But actually I don't now much about the project and their dependencies. So I don't know which dependencies belongs together and therefore need to be updated together. As far as I can see it, most of those 8 PRs are independent and a group wouldn't help here...

Can't we configure it to group all? Like "renovate" does in the ArrowKt's repos.
The problem is those are too many PRs and after being merged in main each PR will send an APK and spam the Telegram group. Our "APK" workflow is configured to notify Telegram for new builds on commit in main.

Obvious groups are the bundles in libs.versions.toml... Like:

• Compose
• Kotlin
• etc

For a beginning group all would be perfect. One PR that updates all deps

[ILIYANGERMANOV]

Alternatively we can try a way to fix the "APK" workflow to not spam but Compose and Kotlin deps.must be updated at the same time for sure

[ILIYANGERMANOV]

Kotlin and Compose also should come together
https://developer.android.com/jetpack/androidx/releases/compose-kotlin

Can you send me docs for dependabot configs - I can configure it, I know which dependencies should be grouped

[ILIYANGERMANOV]

Hey @StefMa nvm - I saw how to group - them. It's easy! Thank you for introducing dependabot 🎉