Investigate options for lowering dependency upgrades noise

[rhusar]

Problems

1. Currently, certain dependencies produce a lot – e.g. last week there were 5 AWS SDK ones – dependency upgrades. Moreover, some of these projects don't seem to adhere to semver as they do include features in PATCH version releases while those as defined as "version when you make backwards compatible bug fixes".
2. This generates a lot of notifications for project owners following PR notifications; n.b. this is not a problem for consumers, as those can only setup to watch releases or issues.
3. Merging all upgrades also makes git log harder to manage.

The reasons why we want to consume the latest versions are to:

1. Consume latest security patches.
2. Be able to detect intentional and unintentional breaking changes timely.
3. Provision the most up to date version for users consuming the project using the Maven mvn dependency:copy-dependencies -DoutputDirectory=$RHDG_HOME/server/lib -DincludeScope=runtime -DexcludeGroupIds=org.jgroups method.

Options - sorted from worst to best:

1. Disable updates completely.
2. Enable automatic merging – this would require the CI to be able to consume secret credentials and test against live cloud provider instance. Still generates notifications.
3. Disable updates for PATCH (MICRO) releases from certain noisy dependencies.
4. Keep update configuration as is, project owners disable PR notifications for the project. Only test and bump before the release or whenever we get to it. Might miss community PRs but we can employ CODEOWENERS for actual code changes to request review from owners.

Other suggestions? Thoughts?

[belaban]

I'd vote for option 3. However, do as you like, this is your project.

[belaban]

This is getting really annoying: I suggest we ignore the micro updates in dependabot. Or, if there's a way, I'd like to remove myself from getting update notifications...

[rhusar]

@belaban OK (back from PTO) - let's go with option 3! Done (might need some fine tuning if this doesn't work just yet).

[belaban]

thx!