Automate dependency updates in Gradle projects with Dependabot

[luongvo]

Issue

Our template is enabling Dependabot, but it's being used only to report Ruby dependency https://github.com/nimblehq/android-templates/pulls?q=is%3Apr+Dependabot. There is no config to report for Android project dependency updates yet.

Solution

We now can apply to use Dependabot to automate dependency updates in Gradle projects (Android) 🎉 . There is a nice article about this: https://proandroiddev.com/automate-dependency-updates-in-gradle-projects-with-dependabot-8f0092a89de9.

There were some issues with Dependabot before. However it's now 2022, they are resolved and released so the bot is ready to use in Android project:

• Support Kotlin when updating Gradle files dependabot/dependabot-core#2238
• [Feature request] Opt out minor and patch versions dependabot/dependabot-core#2219

Who Benefits?

Developers

What's Next?

• Update to use corresponding Dependabot app.
• Add dependabot.yml to report dependency updates for Android project.

[toby-thanathip]

@luongvo I like the idea, but I'm not sure if this will be feasible as we specify the versions in a separate file (Versions.kt)

Reference: dependabot/dependabot-core#2238 (comment)

[luongvo]

@Tuubz I think we could keep this initiative in 2 steps:

• Experiment with new Dependabot to automate dependency updates in Gradle projects.
• Apply to use Dependabot to automate dependency updates in Gradle projects.