WIP prototyping an action to add changelogs for dependabot 2

.github/workflows/dependabot_changelog.yml

@@ -0,0 +1,52 @@
+name: Write changelog for dependabot PR
+on:
+  # /!\ pull_request_target is a security concern as it grants a read-write GITHUB_TOKEN
+  # within this workflow. We mitigate the risk by:
+  #  - ensuring this workflow does nothing when NOT triggered by dependabot
+  #  - downscoping permissions to the bare minimum.
+  # See https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions
+  # and in particular the section "Responding to events" for advice. (That page
+  # recommends an untrusted/trusted workflow pair, but that is overkill for this
+  # workflow.)
+  pull_request_target:
+    types:
+      - opened
+
+permissions:
+  # The list of permission scopes is defined here:
+  # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+  # and here:
+  # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
+  # The best reference I could find for their meanings is:
+  # https://docs.github.com/en/rest/overview/permissions-required-for-github-apps
+  actions: none
+  checks: none
+  contents: write
+  deployments: none
+  id-token: none
+  issues: none
+  discussions: none
+  packages: none
+  pages: none
+  pull-requests: none
+  repository-projects: none
+  security-events: none
+  statuses: none
+
+jobs:
+  add-changelog:
+    runs-on: 'ubuntu-latest'
+    if: ${{ github.actor == 'dependabot[bot]' }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+      - name: Write, commit and push changelog
+        run: |
+          echo "${{ github.event.pull_request.title }}." > "changelog.d/${{ github.event.pull_request.number }}".docker
+          git add changelog.d
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git config user.name "GitHub Actions"
+          git commit -m "Changelog"
+          git push
+        shell: bash