Configure dependabot behavior

[drewbo]

Consider how we want to handle dependabot behavior for security updates

Notes

• We currently see a large number of dependabot PRs that are hard to manage
• Create a dependabranch to have all dependabots to create PRs. Not Possible
• Identify a cadence for review and updates.

Acceptance Criteria

• Talk with the platform team on their procedures
• Put together a run book / docs

[drewbo]

Security updates won't respect target-branch in the dependabot.yml config so we can't create a dependabranch (😞). My proposal for now:

• [ci skip] incoming dependabot PRs so they don't add noise to our dev environment (plus they can't be merged directly anyway, added in Optimize dev deployment #4222)
• "Quickly" rebase/merge/release any PR which addresses a critical or high vulnerability. We could also gate PRs/deploys on whether they introduce any vulnerabilities. Let's confer with others on timelines.
• Otherwise do quarterly dependency reviews with yarn audit and work towards removing/updating other old dependencies

[apburnes]

Try to schedule time with platform this week.

[drewbo]

Closed via https://github.com/cloud-gov/internal-docs/pull/143