Retime JS dependency update cron, and make new dependabot alert issue

[GuySartorelli]

In a recent CMS Squad retrospective we identified that the cron for creating the "JS pull-requests" GitHub issue is out-of-sync with our release schedule.

Currently this issue is created quarterly, with the second one being created shortly after a minor release. We do a minor release every 6 months.

Acceptance criteria

• Retime cron in js-prs-issue.yml to run every 6 months, roughly 1 month before we'd schedule a beta release
• Retime cron in update-js workflows for all supported modules to run every 6 months, roughly 1 month before we'd schedule a beta release
• Double check that the information in the generated issue is still accurate with the new timing.
• Either make a separate workflow or update the current one so that a separate issue is created explicitly only for checking dependabot alerts. This should be run either:
  • every 3 months, completely separately from the one that's currently created (and remove dependabot from the one that's currently created)
  • every 6 months, with a 3 month offset from the one that's currently created (and leave dependabot in the one that's currently created)
• The dependabot-only issue should state to do:
  • a quick spot check to see if anything needs to be handled via security process
  • merge whatever can be merged
  • backport anything that seems like it needs to be patched immediately
• Check if it’s possible to configure dependabot to look at more than the default branch. If it is:
  • make dependabot check the correct branch even for repos we don't own (some of these have the wrong default branch)
  • Document somewhere (maybe in the release process) that when we do a major release we need to have dependabot checking both the default branch and the previous major branch, while both are supported

PRs

• https://github.com/silverstripe/.github/pull/254
• https://github.com/silverstripe/module-standardiser/pull/54

Module Standardiser PRs

• https://github.com/bringyourownideas/silverstripe-maintenance/pull/227
• https://github.com/colymba/GridFieldBulkEditingTools/pull/288
• https://github.com/silverstripe/cwp-agencyextensions/pull/122
• https://github.com/silverstripe/cwp-starter-theme/pull/254
• https://github.com/silverstripe/cwp-watea-theme/pull/189
• https://github.com/silverstripe/developer-docs/pull/525
• https://github.com/silverstripe/silverstripe-elemental/pull/1199
• https://github.com/silverstripe/silverstripe-admin/pull/1760
• https://github.com/silverstripe/silverstripe-asset-admin/pull/1464
• https://github.com/silverstripe/silverstripe-blog/pull/760
• https://github.com/silverstripe/silverstripe-campaign-admin/pull/308
• https://github.com/silverstripe/silverstripe-cms/pull/2946
• https://github.com/silverstripe/silverstripe-contentreview/pull/236
• https://github.com/silverstripe/silverstripe-documentconverter/pull/82
• https://github.com/silverstripe/silverstripe-elemental-bannerblock/pull/147
• https://github.com/silverstripe/silverstripe-externallinks/pull/128
• https://github.com/silverstripe/silverstripe-gridfieldqueuedexport/pull/109
• https://github.com/silverstripe/silverstripe-linkfield/pull/293
• https://github.com/silverstripe/silverstripe-lumberjack/pull/151
• https://github.com/silverstripe/silverstripe-realme/pull/143
• https://github.com/silverstripe/silverstripe-session-manager/pull/197
• https://github.com/silverstripe/silverstripe-segment-field/pull/110
• https://github.com/silverstripe/silverstripe-sharedraftcontent/pull/237
• https://github.com/silverstripe/silverstripe-sitewidecontent-report/pull/91
• https://github.com/silverstripe/silverstripe-subsites/pull/574
• https://github.com/silverstripe/silverstripe-tagfield/pull/290
• https://github.com/silverstripe/silverstripe-userforms/pull/1296
• https://github.com/silverstripe/silverstripe-versioned-admin/pull/343
• https://github.com/symbiote/silverstripe-advancedworkflow/pull/536
• https://github.com/symbiote/silverstripe-multivaluefield/pull/112
• https://github.com/tractorcow-farm/silverstripe-fluent/pull/858
• https://github.com/silverstripe/silverstripe-mfa/pull/544
• https://github.com/silverstripe/silverstripe-totp-authenticator/pull/160
• https://github.com/silverstripe/silverstripe-webauthn-authenticator/pull/182
• https://github.com/silverstripe/silverstripe-login-forms/pull/180
• https://github.com/silverstripe/doc.silverstripe.org/pull/299
• https://github.com/silverstripe/silverstripe-frameworktest/pull/182

[GuySartorelli]

We can configure the branch dependabot uses - but it's a bit confusing. It looks like it'll still use the default branch for dependabot alerts but then create pull requests against the branches you define? I'd rather not mess with this. It's more consistent to get alerts and PRs for the same branch.

[emteknetnz]

Reassigning to Guy to:

• Manually run the new workflow to check the dependabot issue is created as expected
• Run module standardisers to update the crons on update-js workflows

[GuySartorelli]

Both actions work well.

[emteknetnz]

PRs merged