Setup dependabot updates for more layers, and improve commits (#8073)

This configures dependabot to update our GitHub actions, our pre-commit
steps, and our Bazel modules.

It also adds a workflow to replace PR descriptions from Dependabot with
ones that work well with our squash-merge setup.

Last but not least, a couple of cases were missing SHA-pinning and it is
added here.

Assisted-by: Antigravity with Gemini

.github/dependabot.yml

@@ -0,0 +1,61 @@
+# Part of the Carbon Language project, under the Apache License v2.0 with LLVM
+# Exceptions. See /LICENSE for license information.
+# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+
+# Dependabot version updates for our GitHub Actions, pre-commit hooks, and Bazel
+# modules. See .github/workflows/README.md for how these PRs are handled.
+#
+# Updates keep our existing pinning: actions stay pinned to full commit SHAs
+# with a `# vX.Y.Z` comment, and pre-commit hooks stay frozen to commit SHAs
+# with a `# frozen: vX.Y.Z` comment.
+#
+# Security updates for other ecosystems, such as npm and pip, are enabled in the
+# repository settings and don't need an entry here.
+
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    # `/` only covers `.github/workflows`; list composite actions separately.
+    directories: ['/', '/.github/actions/*']
+    schedule:
+      interval: weekly
+    # Give new releases a week to be vetted before we adopt them.
+    cooldown:
+      default-days: 7
+    # Use our existing label instead of Dependabot's per-ecosystem labels.
+    labels: ['dependencies']
+    groups:
+      # Batch minor and patch updates, but put major updates in a separate PR so
+      # they get a closer look.
+      github-actions:
+        patterns: ['*']
+        update-types: ['minor', 'patch']
+      github-actions-major:
+        patterns: ['*']
+        update-types: ['major']
+
+  - package-ecosystem: pre-commit
+    directory: '/'
+    schedule:
+      interval: monthly
+    cooldown:
+      default-days: 7
+    labels: ['dependencies']
+    groups:
+      pre-commit:
+        patterns: ['*']
+
+  # Dependabot regenerates `MODULE.bazel.lock` on a single platform, so the test
+  # workflow may still ask for platform-specific lockfile updates. LLVM is
+  # pinned with `git_override`, which Dependabot doesn't update.
+  - package-ecosystem: bazel
+    directory: '/'
+    schedule:
+      interval: monthly
+    cooldown:
+      default-days: 7
+    labels: ['dependencies']
+    groups:
+      bazel:
+        patterns: ['*']

.github/workflows/auto_label_prs.yaml

@@ -113,7 +113,7 @@ jobs:
       # and it applies orthogonally to the others.
       - id: bot
         if:
-          contains(fromJSON('["CarbonInfraBot", "dependabot"]'),
+          contains(fromJSON('["CarbonInfraBot", "dependabot[bot]"]'),
           github.event.pull_request.user.login)
         run: |
           gh pr edit "${PR}" --add-label "bot" --repo carbon-language/carbon-lang

.github/workflows/dependabot_pr_description.yaml

@@ -0,0 +1,70 @@
+# Part of the Carbon Language project, under the Apache License v2.0 with LLVM
+# Exceptions. See /LICENSE for license information.
+# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+
+# Replaces Dependabot's PR description with a short markdown list of the updated
+# dependencies. We squash-merge using the PR description as the commit message,
+# and Dependabot's descriptions are mostly HTML: release notes, commit lists,
+# and command help. The original description remains in the PR's edit history.
+name: 'Dependabot PR description'
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, edited]
+
+# Dependabot can push and edit the description in quick succession.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  rewrite:
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # For dependabot/fetch-metadata to read the PR's commit.
+      pull-requests: write # For `gh pr edit`.
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        with:
+          disable-sudo: true
+          egress-policy: block
+          # prettier-ignore
+          allowed-endpoints: >
+            api.github.com:443
+
+      - id: metadata
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
+
+      - name: Replace the description
+        env:
+          BODY: ${{ github.event.pull_request.body }}
+          DEPENDENCIES: ${{ steps.metadata.outputs.updated-dependencies-json }}
+          GH_TOKEN: ${{ github.token }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          # Only replace a description that Dependabot wrote, which always
+          # contains this marker. This leaves human edits alone, and catches
+          # Dependabot restoring its description when it rebases.
+          if [[ "$BODY" != *dependabot-automerge-start* ]]; then
+            echo "The description isn't Dependabot's, so leaving it alone."
+            exit 0
+          fi
+
+          # One short line per dependency. GitHub hard-wraps squash commit
+          # messages at 72 columns, so avoid tables and long links.
+          body="$(jq -r '
+            unique_by([.dependencyName, .prevVersion, .newVersion])[]
+            | "- `\(.dependencyName)` \(.prevVersion) -> \(.newVersion)"
+              + if .updateType == "version-update:semver-major"
+                then " (major)" else "" end
+          ' <<<"$DEPENDENCIES")"
+          if [[ -z "$body" ]]; then
+            echo "Found no updated dependencies, so leaving it alone."
+            exit 0
+          fi
+
+          gh pr edit "$PR_URL" --repo "$GITHUB_REPOSITORY" --body "$body"

.pre-commit-config.yaml

@@ -4,6 +4,7 @@
 
 # Update versions with:
 #   pre-commit autoupdate --freeze && pre-commit run -a
+# Dependabot also proposes monthly updates; see .github/dependabot.yml.
 # See https://pre-commit.com for more information
 # See https://pre-commit.com/hooks.html for more hooks
 
@@ -32,7 +33,7 @@ repos:
   # Run markdown linting early so that doc style and table-of-contents see the
   # linted state.
   - repo: https://github.com/rvben/rumdl-pre-commit
-    rev: v0.2.58
+    rev: e95b9121d4c55bf12fb7ae52d08d2d8d64789899 # frozen: v0.2.58
     hooks:
       - id: rumdl
         args: [--fix]
@@ -51,7 +52,7 @@ repos:
   # Re-run markdown linting to fix any issues caused by doc style and TOC. This
   # is very fast, so it shouldn't be problematic to run twice.
   - repo: https://github.com/rvben/rumdl-pre-commit
-    rev: v0.2.58
+    rev: e95b9121d4c55bf12fb7ae52d08d2d8d64789899 # frozen: v0.2.58
     hooks:
       - id: rumdl
         args: [--fix]