Add Renovate configuration

[opentelemetrybot]

See open-telemetry/sig-security#115 for details

[xrmx]

Wouldn't this create a mess on test requirements for old versions?

[emdneto]

Wouldn't this create a mess on test requirements for old versions?

Hmmmm. Not sure. I think we should probably migrate from Dependabot to Renovate due to the possibility of ignoring paths for the whole repo.

@trask, we are already using Dependabot, but there are a lot of warnings about dependencies in test-requirements.txt that we can't fix (it is only used during tests in CI to guarantee things work at the lower-direct resolution of dependencies). Is there any guidance/best practice for migrating to renovate and ignore those test-requirements.txt?

[emdneto]

some questions about the configuration

[trask]

we are already using Dependabot

I don't see it enabled? https://github.com/open-telemetry/opentelemetry-python-contrib/network/updates

it is only used during tests in CI to guarantee things work at the lower-direct resolution of dependencies

yeah, we have the same issue in Java instrumentation repo. we have ignored the entire instrumentation directory:

https://github.com/open-telemetry/opentelemetry-java-instrumentation/blob/2e5c12bfd6fee02e2282234e90fb926d5da4ea1c/.github/renovate.json5#L7-L9

there may be better ways, but this was easy and lets us keep other dependencies up-to-date

[emdneto]

we are already using Dependabot

I don't see it enabled? https://github.com/open-telemetry/opentelemetry-python-contrib/network/updates

it is only used during tests in CI to guarantee things work at the lower-direct resolution of dependencies

yeah, we have the same issue in Java instrumentation repo. we have ignored the entire instrumentation directory:

https://github.com/open-telemetry/opentelemetry-java-instrumentation/blob/2e5c12bfd6fee02e2282234e90fb926d5da4ea1c/.github/renovate.json5#L7-L9

there may be better ways, but this was easy and lets us keep other dependencies up-to-date

Awesome! Thanks for sharing.

About the dependabot warnings: https://github.com/open-telemetry/opentelemetry-python-contrib/security/dependabot