gh: Use renovate to update dependencies

[garazdawi]

This change moves github actions updating to renovate and adds monitoring of vendored dependencies as well as automatically providing the code needed for the update.

[github-actions]

CT Test Results

    3 files    142 suites   49m 30s ⏱️
1 649 tests 1 591 ✅ 57 💤 1 ❌
2 372 runs  2 294 ✅ 77 💤 1 ❌

For more details on these failures, see this check.

Results for commit cdf958a.

♻️ This comment has been updated with latest results.

To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass.

See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally.

Artifacts

• Complete CT logs (Download Logs)
• HTML Documentation (Download HTML Docs)
• Windows Installer

// Erlang/OTP Github Action Bot

[kikofernandez]

if the update-vendored-deps.sh is going to run the updates, then some script should do this update for the ${ERL_TOP}/erts/emulator/ryu/xcharconv_ryu.h.sha, isn't it?

[garazdawi]

I guess the point here is that it cannot be done automatically. I'll see what I can do to handle this scenario better.

[garazdawi]

I've updated it so that a comment is posted to the PR that the update needs to be done manually in this scenario.

[kikofernandez]

I think we should document somewhere how the update scripts work, overall, and not just ryu.

• If someone wants to update vendor dependencies, we should document that this can be done calling update-vendored-deps.sh instead of each individual update.sh file,
• that a .githubtoken file must exist "somewhere" as a requirement, in order to run it locally,
• that update.sh files will do a commit and update the vendor.info files,
• the <vendor>.sha is there only for documentation purposes, and
• update-vendored-deps.sh should run in local mode if you run it outside Github CI/CD, which avoids pushing to remote (default flag should be to run without push, so that only when we run in Github CI/CD we pass the flag to push, which is safer default than the opposite).

Maybe I am overthinking this, but there is a connection between scripts that we will forget with time.
If the scripts do not work, we should understand how to fix it in 1 min and its connection

[garazdawi]

I don't think that you should call this script to update vendored deps, instead the individual update.sh scripts should be called directly. This script should only be used by github actions to generate updates.

The reason for this is that you most likely don't want to update all the deps, only a specific one as otherwise you may have to deal with fixing API issues in the jit because of an asmjit update when all you wanted to do was to update jquery to the latest version.