add dependabot config script

[davidspek]

Inspired by kubeflow/pipelines#4682 I created a script that will create a config file for depandabot so that it knows what directories to scan. It will scan the repository for files named *ockerfile*, package*.json, *requirements.txt and go.*. It is setup for dockerfiles and gomod at the moment. As I am not sure if the go.mod and go.sum in ./vendor are relevant, I did not include searching for go.* files in the script. It is trivial to further customize what folders are selected if further customization is needed. It also parses the closest OWNERS file for a given directory and assigns the approvers and adds the reviewers to the PRs it creates.

This is a sibling PR to kubeflow/pipelines#5015, kubeflow/kubeflow#5542, kserve/kserve#1309 and kubeflow/arena#403.

As it stands now, there are about 56 PRs that will be created with this configuration, so it might be advisable to have some form of plan to implement it in stages or be ready to quickly go through lots of the PRs. Another option is to create a target branch for all these PRs so they can be merged into that first rather than master.

For reference, the PRs that will be created can be found here: https://github.com/DavidSpek/testing/pulls

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: DavidSpek
To complete the pull request process, please assign jlewi after the PR has been reviewed.
You can assign the PR to them by writing /assign @jlewi in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[PatrickXYS]

Overall lgtm, some nit comments:

1. Have a make command to run create_dependabot.sh
2. Update README doc to have another section for dependabot functionality and description in this repo

[davidspek]

/assign @PatrickXYS

[davidspek]

I am holding the PR to have some control over when it gets merged so that the optional test infra doesn't get overloaded if all the repo's were to merge this at the same time.
/hold

[PatrickXYS]

Can we close the PR in favor of enabling Renovate?

[davidspek]

I’d say so. I’ll create a PR with an initial Renovate config based on the Pipelines one.