feat: enable Dockerfile check for dependabot

[kruskall]

What does this pull request do?

keep docker image up to date

Related issues

Closes #ISSUE

[trentm]

We have the same for apm-agent-nodejs.git FWIW.

[kruskall]

(note: I don't have permission to merge this)

[trentm]

ping @xrmx

[xrmx]

Don't we have already renovate for that?

[xrmx]

Closing this since we already have renovate. I don't merge renovate PRs often because they bump the major python version image that I don't want to.

[kruskall]

Sorry for reopening and for the late reply 😓

Don't we have already renovate for that?

I think renovate config is only enabled for chainguard images:

apm-agent-python/renovate.json

Line 4 in a15ec54

"github>elastic/renovate-config:only-chainguard"

I'll leave it up to you and the python agent team to decide whether you want to extend the config to other docker images or want to use renovate but the image should be kept up to date.

I don't merge renovate PRs often because they bump the major python version image that I don't want to.

I don't think this is ok :(
I see #2206 is open for example. Maybe the config can be updated to not bump major versions ? cc @jamietanna

[xrmx]

Sorry for reopening and for the late reply 😓

Don't we have already renovate for that?

I think renovate config is only enabled for chainguard images:

apm-agent-python/renovate.json

Line 4 in a15ec54

"github>elastic/renovate-config:only-chainguard"

I'll leave it up to you and the python agent team to decide whether you want to extend the config to other docker images or want to use renovate but the image should be kept up to date.

I would like to use just one tool for the same purpose

I don't merge renovate PRs often because they bump the major python version image that I don't want to.

I don't think this is ok :( I see #2206 is open for example. Maybe the config can be updated to not bump major versions ? cc @jamietanna

That would be great of course

[jamietanna]

I see #2206 is open for example. Maybe the config can be updated to not bump major versions ? cc @jamietanna

Do we mean "major" version here? (I'm reading this in terms of Semantic Versioning)

#2206 seems to be bumping minor version of Python

I think yes, if we don't want to have Python minor bumps happening automagically, but only when a human triggers them via the Dependency Dashboard, then that's very achievable - wanna drop into the #renovate channel and discuss, if you need a hand?

[xrmx]

I think yes, if we don't want to have Python minor bumps happening automagically, but only when a human triggers them via the Dependency Dashboard, then that's very achievable - wanna drop into the #renovate channel and discuss, if you need a hand?

Will do thanks

[xrmx]

Handing the update to dependabot has been merged in #2246 . Now I just need to configure it 😓