[Feat] CI: limit noise by Renovate updates

[nilason]

Currently, Renovate generates almost daily updates on some CI action. One such update triggers a PR, which someone must approve, and subsequently merge. This means at least three emails for someone that signed up to watch the progress of this project!

The number of commits to main that only updates the actions in the last three months amounts to 94, that is around a quarter of the total number of commits ¹. This causes unnecessary noise and maintenance work, which only distracts from really important events for the project (and frankly, not a small amount of irritation on my side).

I suggest to put the Renovate on a schedule, with updates perhaps monthly or, better, every quarter of a year. If some action is broken in between, we will probably notice and it can be updated manually.

Footnotes

1. Calculated with git log --oneline --since=2024-07-08 --grep="CI(deps): Update*" main | wc -l vs. git log --oneline --since=2024-07-08 main | wc -l ↩

[nilason]

I should add that the unnecessary noise also regards to the commit history.

[echoix]

Would you want to try weekly before that? Or twice a month?
We should at least keep the lock files weekly preset, that keeps the nix cache updated weekly, and tests that build weekly.

[nilason]

I'd say default to quarterly, and exempt whatever needed for nix to weekly.

[echoix]

There's also the 4 docker image pins (instead of moving tags) that could just be free whenever to be able to use the respins when they are re-published (the packages are updated, and is most useful for security patches). These are done about once a month each, so being quarterly would mean security patches up to 3+1 months after the docker image respin, that doesn't happen immediately too.

[nilason]

Given this another thought. What about default to quarterly, with nix and docker monthly? Let's get this ticket moving, please.

[wenzeslaus]

Quarterly and monthly sounds good. Is there a setting to get, e.g., high-severity security updates right away?

The renovate bot is also our largest contributor in the last 2 years in terms of commits. That's probably okay, but I find it funny.

[echoix]

I would need to read if there's something to do to get security updates right away or it just does that by default. Otherwise, all PRs can be created with the Dependency Dashboard PR, they will be in a section "awaiting schedule". So we can create them on a case-by-case basis if needed.

GDAL chose monthly dependabot updates.