Enable renovate for @ampproject scoped dependencies

[kristoferbaxter]

Describe the new feature or change to an existing feature you'd like to see

Enable Renovate updating for dependencies scoped under the @ampproject namespace – these are intended to update AMP when released.

Describe alternatives you've considered

Alternatives:

1. Build a seperate automatic upgrade system to enable this feature set.
2. Manually update each @ampproject dependency on each release.

Additional context

We're trying to tighten up the release cycle between WorkerDOM updates and their availability in amp-script.

[dreamofabear]

IIRC, the impetus behind #23008 was a react/moment upgrade that broke part of amp-date-picker. Maybe we can reinstate the selective ignore? It'd be nice to have auto-upgrades for dompurify too.

[rsimha]

Good idea, definitely possible.

[rsimha]

@choumx @kristoferbaxter I started putting together a PR for this, and had a thought: Would it make sense to re-enable renovate upgrades for all dependencies and rely on the new owners bot to alert the right folks to review and validate the upgrades for runtime deps before merging them?

IIRC, the react/moment breaking upgrade was a one off, so I'm wondering where the sweet spot is between risk and freshness.

Your thoughts?

[dreamofabear]

Would the bot need line-level owners support to do that?

[rsimha]

Would the bot need line-level owners support to do that?

Yes, it would need line-level support. We've discussed this in ampproject/amp-github-apps#283 and ampproject/amp-github-apps#284.

/cc @rcebulko to comment on if / when the owners bot will be able to auto-assign dependency upgrades to individuals / teams.

[rcebulko]

It is indeed in the pipeline, but it's a P3 right now and there are some higher priority issues regarding the deployment process that have been pushed off a bit in favor of getting certain features done in time for the contributor summit. If anyone has strong feelings about escalating the priority of dependency owners, please comment on that thread so the context is there when I can pick it up :)

[rsimha]

For the time being, I think we can selectively enable updates for @ampproject* in dependencies. Bumping to P2.

[rcebulko]

These have been enabled, but are not auto-merged because I believe we don't want to give Renovate those permissions at this time. I'm closing this issue for now, but we can re-open down the line if auto-merging becomes necessary/desirable.