improve dependabot config and commit the lockfile

[danieleades]

commits the Cargo.lock lockfile to version control and updates the dependabot config to limit the 'noise'.

• committing the lockfile matches the official guidance
• it provides consistent and deterministic build environments for all contributors and for CI

[danieleades]

i expect the tempo and grouping of updates will need some discussion

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 87.35%. Comparing base (3615030) to head (c7fb779).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #120   +/-   ##
=======================================
  Coverage   87.35%   87.35%           
=======================================
  Files          32       32           
  Lines        3376     3376           
=======================================
  Hits         2949     2949           
  Misses        427      427           

Flag	Coverage Δ
cqrs	84.43% <ø> (ø)
mysql	88.69% <ø> (ø)
postgres	65.58% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[serverlesstechnology]

What is the argument to commit the lock file here? That feels a little awkward in a library (though it may make sense in the demo).

[danieleades]

What is the argument to commit the lock file here? That feels a little awkward in a library (though it may make sense in the demo).

There are several arguments, some of which are laid out in this blog post.

Specifically for this project, it means that:

• different contributors have exactly the same local environment during development
• the CI environment is using exactly the same dependencies as local development
• you don't get inadvertent MSRV bumps due to the CI environment resolving newer dependencies than the local lock file
• the cargo-deny results will match the pinned dependencies until the lock file is updated, not just what happened to get resolved at the time the job ran

The only real downside is a bit more noise from dependabot, but if you like I could add a job for automatically merging dependabot PRs for which all the jobs pass.

Take a look at the config and see if it matches the behaviour you would want. For example I could also make minor updates monthly rather than on demand, etc.

[danieleades]

@davegarred i've added a job which will automatically merge dependabot PRs that pass CI, though i recommend configuring the repo to not allow merging PRs that are not up-to-date with main before merging this