Add Github action to auto merge dependabot and pyup security updates if all tests pass.

Description

What are you proposing? How should it be implemented?

I propose to add a new GitHub action or job that will auto merge pull requests from the pyup bot and the dependabot should the PR so created has no merge conflicts with master and all tests also pass.

This will be very similar to how pre-commit tool versions in the repo root are kept up to date.

Rationale

Why should this feature be implemented?

This would make updating requirements easier and more automated and would likely also make the project more secure. The tests are used to make the decision to merge updates from dependabot and pyup right now anyway.

[Andrew-Chen-Wang]

@browniebroke You can just go into GitHub marketplace and add dependabot-preview. Then you can select the repo, select which requirements files you want, choose the labels you want, and it’ll auto update, just like how pyup does it. You can see the outcome here where dependabot just litters my repo with updates to botocore and boto3 lmao.

You can find more info on configuring the auto merge here: https://dependabot.com/docs/config-file/#automerged_updates

If I’m not wrong, since GitHub bought dependabot, I think you don’t even need to register in dependabot. You can just create their .dependabot.yaml file… somewhere… I can’t remember.

[Andrew-Chen-Wang]

I think this issue can be closed with the comments from #2872