Switching dependency bot to renovate

[XSAM]

Problem Statement

• An update for a single dependency across our go submodules would occur in multiple PRs. It is annoying.
• GitHub's dependabot doesn't support docker-compose files. Support for Docker compose files dependabot/dependabot-core#390

Proposed Solution

Switch to renovate

Additional Context

#5244 (comment)

Tasks

• Remove dependabot version updates #5346
• Remove dependabot version updates in the contrib repo. Remove dependabot version updates opentelemetry-go-contrib#5577

[pellared]

This config can be used as a reference: https://github.com/signalfx/splunk-otel-go/blob/main/renovate.json

• this also bumps indirect dependencies (except build directory)
• runs go mod tidy
• ensures that all folders are checked (e.g. test are excluded by default)

e.g.

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended"
  ],
  "ignorePaths": [],
  "separateMajorMinor": true,
  "postUpdateOptions" : [
    "gomodTidy"
  ],
  "packageRules": [
    {
      "matchManagers": ["gomod"],
      "matchDepTypes": ["indirect"],
      "enabled": true
    },
    {
      "matchFileNames": ["internal/tools/**"],
      "matchManagers": ["gomod"],
      "matchDepTypes": ["indirect"],
      "enabled": false
    }
  ]
}

[MrAlias]

This should be unblocked: open-telemetry/community#2090 (comment)

[pellared]

@XSAM, I updated open-telemetry/opentelemetry-go-contrib#4579

[XSAM]

I don't know why this repo didn't receive any Configure Renovate PR.

[XSAM]

FYI, the default config file looks like this

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended"
  ]
}

[pellared]

FYI, the default config file looks like this

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended"
  ]
}

I know but I want to at least make sure that go mod tidy is run and test Go modules are not ignored.

[XSAM]

The renovate bot failed to create Renovate PR because it got a 422 Error from GitHub. https://developer.mend.io/github/open-telemetry/opentelemetry-go/-/job/817ca928-01ff-4038-a171-0296c06ab5ad

[pellared]

It fails because we are probably missing this rule in this repo: https://github.com/open-telemetry/community/blob/main/docs/how-to-configure-new-repository.md#branch-protection-rule-renovate

[MrAlias]

To resolve this, is the plan to rip out all the dependabot tooling and disable the bot on the repo?

[XSAM]

To resolve this, is the plan to rip out all the dependabot tooling and disable the bot on the repo?

Recap the discussion at the meeting, we will disable dependabot for version updates, but keep the vulnerability alerts.

[MrAlias]

Are there any more tasks for this? Can this be closed?

[XSAM]

I will prepare a PR for contrib.