Add new experimental github dependabout workflow

[hz-xiaxz]

Description

quoted from https://discourse.julialang.org/t/this-month-in-julia-world-2025-10/133753

The Github bot dependabot which automates updates to compat bounds in many ecosystems now has beta support for Julia, providing a much more standard alternative to the current CompatHelper custom julia bot. Benefits over CompatHelper include: showing release notes/changelogs for the new version in the PR, updating checked-in manifests and warning when it cannot be updated, CI running automatically (without close-open), not having to worry about workflows being silently turned off after a few months of repo inactivity. It’s aligned with a push to integrate better with github’s CVE management systems. See examples of PRs and example setups. It is in a testing period and feedback would be much appreciated.

Validation and testing

No response

Motivation

No response

Target audience

No response

Can you help?

Yes, maybe.

[abelsiqueira]

I hope it becomes mainstream. In the meantime, it could be added as an advanced option, like ManageCompatViaDependabot. Since it interacts with CompatHelper and depends on AddDependabot, it might be a bit annoying to setup at the moment, but I'm not opposed to it as an advanced option. Let me know if you want to look into it, otherwise, I'll try to pick it up eventually

[hz-xiaxz]

Thanks for being interested in that, I believe more people would benefit from the update. I'm currently out of bandwidth to deal with it in next two weeks, but may have some spare time at the beginning of December. If the modification is only in the copier folder and add the new ci script, I believe it's inside my capablity scope to help!

[gdalle]

Just stopping by to say that this would make a lot of sense, from a user perspective dependabot updates are a bit nicer to deal with than CompatHelper.
This functionality is still experimental though, and @IanButterworth is still working out some last kinks.

[IanButterworth]

It's now officially supported https://github.blog/changelog/2025-12-16-dependabot-version-updates-now-support-julia/

JuliaCI/PkgTemplates.jl#516

[abelsiqueira]

That's great news, thanks @IanButterworth
I'll try to work on this in the next few days

[abelsiqueira]

Dependabot is included in 0.18.0 now