Use dependabot for simplifying GitHub actions version management

[marcwrobel]

Description

GitHub action versions seems rarely updated. For instance ci-actions-incremental.yml is still using action/checkout@v2 even if action/checkout@v3 has been released a few months ago.

Dependabot is used in the project for managing some of the Maven and Gradle dependencies. But it can also manage GitHub actions version (package ecosystem github-actions).

Should Dependabot be used for managing GitHub actions versions ?

Implementation ideas

Add the following to https://github.com/quarkusio/quarkus/blob/main/.github/dependabot.yml :

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: daily
      time: "21:00"
      timezone: Europe/Paris
    open-pull-requests-limit: 4
    labels:
      - area/devtools
    rebase-strategy: disabled

[geoand]

Interesting idea. Would you like to open a PR for this?