chore(deps-dev): bump frequenz-repo-config from 0.16.0 to 0.18.0 in the repo-config group across 1 directory

[dependabot]

Bumps the repo-config group with 1 update in the / directory: frequenz-repo-config.

Updates frequenz-repo-config from 0.16.0 to 0.18.0

Release notes

Sourced from frequenz-repo-config's releases.

v0.18.0

Frequenz Repository Configuration Release Notes

Summary

This release focuses on finishing the automation of dependabot updates, adding more automated upgrade workflows and fixing some problems with the previous release.

Upgrading

Cookiecutter template

All upgrading should be done via the migration script or regenerating the templates.

curl -sSLf https://raw.githubusercontent.com/frequenz-floss/frequenz-repo-config-python/<tag>/cookiecutter/migrate.py | python3 -I

New Features

Cookiecutter template

• The cookiecutter now asks whether a repository is private, defaults that answer from the selected license, and uses it to toggle private-repository workflow behavior, public publishing jobs, and the link to GitHub Discussions in the issue template chooser.
• All dependencies have been updated in the templates.
• API projects now ship a dedicated grpc-migration.yaml workflow that runs after Dependabot bumps grpcio/grpcio-tools/protobuf and rewrites the matching runtime >= floors in pyproject.toml.
• API projects now have a better grpcio/protobuf updates grouping in Dependabot, which should make upgrading easier, and plays nicer with the new grpc-migration.yaml workflow.
• API projects should now use the new API-specific Protect version branches ruleset variant, which includes the required Fix gRPC/protobuf runtime floors check without affecting non-API Python projects.
• Workflows using the gh-action-dependabot-migrate are upgraded to the latest version, which avoids unnecessary version iterations.
• Add an isort-migration.yaml workflow that automatically reorders imports when Dependabot upgrades isort.

Bug Fixes

Cookiecutter template

• The unused cross-arch QEMU-based testing infrastructure has been removed. The .github/containers/nox-cross-arch/ and .github/containers/test-installation/ directories, as well as the "Cross-Arch Testing" section in CONTRIBUTING.md.
• Private repositories now are generated with credentials uncommented and the publishing workflows disabled.
• The issue template chooser (config.yml) no longer includes the contact_links section for private repositories, since GitHub Discussions are typically disabled for them.
• Normalized the GitHub Action hashes for gh-action-setup-git and gh-action-setup-python-with-deps to point to the actual commit object, which is what Dependabot expects.
• API projects now configure black with extend-exclude = '^/submodules/' so the formatting check doesn't descend into external git submodules that don't follow our formatting rules.
• API projects now configure isort with skip_glob = ["submodules/*"] so the import-sorting check doesn't descend into external git submodules that don't follow our rules.
• CONTRIBUTING.md
  • Fixed the nox example commands in to use the correct tests/ directory instead of the non-existent test/ directory.
  • Fixed the wrong mention to PyPI publishing when releasing for private repositories.

What's Changed

• Add how to re-trigger a migration to the docs by @​llucax in frequenz-floss/frequenz-repo-config-python#559
• Remove unused cross-arch files and docs by @​llucax in frequenz-floss/frequenz-repo-config-python#547
• build(deps): bump frequenz-floss/gh-action-setup-python-with-deps from 0d0d77eac3b54799f31f25a1060ef2c6ebdf9299 to e4d0b2ef8f5a1612d7827f3abaef17c931d2b946 by @​dependabot[bot] in frequenz-floss/frequenz-repo-config-python#561
• build(deps): bump frequenz-floss/gh-action-nox from 1.1.0 to 1.1.1 in the compatible group by @​dependabot[bot] in frequenz-floss/frequenz-repo-config-python#560
• build(deps): bump frequenz-floss/gh-action-setup-git from 16952aac3ccc01d27412fe0dea3ea946530dcace to f9d86a01228ee1cadaac5224d4d7626f1eb23f90 by @​dependabot[bot] in frequenz-floss/frequenz-repo-config-python#562

... (truncated)

Commits

• 9536002 Update template versions and prepare the v0.18.0 release (#590)
• 0851215 Prepare release notes for v0.18.0
• bee542d template: Bump dependencies
• 80402d2 build(deps): bump the compatible group with 2 updates (#589)
• df8ba24 build(deps): bump the compatible group with 2 updates
• e5f4e39 Add isort dependabot auto-migration workflow (#585)
• 3afcb70 Update release notes
• e86009b Add isort submodules migration step
• 22be0ee template: Make isort exclude submodules from API projects
• a459500 isort: Exclude golden tests
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[llucax]

@dependabot recreate

[github-actions]

Repo Config Migration

Update: 0.16.0 → 0.17.0

✅ Migration completed successfully.

Migration output

=== v0.17.0 =========================================================
Script URL: https://raw.githubusercontent.com/frequenz-floss/frequenz-repo-config-python/v0.17.0/cookiecutter/migrate.py

========================================================================
Updating generated CI workflows...
  Updated .github/workflows/ci-pr.yaml: updated CI pull-request workflow
  Updated .github/workflows/ci.yaml: updated main CI workflow
========================================================================
Fixing missed CI platform matrix migrations...
  Skipped .github/workflows/ci.yaml: platform matrix migration already fixed
========================================================================
Updating generated Dependabot workflows...
  Updated .github/workflows/auto-dependabot.yaml: updated Dependabot auto-merge workflow
  Updated .github/workflows/repo-config-migration.yaml: updated repo-config migration workflow
========================================================================
Creating black migration workflow...
  Created .github/workflows/black-migration.yaml: black formatting migration workflow
========================================================================
Updating auxiliary GitHub workflows...
  Updated .github/workflows/dco-merge-queue.yml: updated DCO merge queue workflow
  Updated .github/workflows/labeler.yml: updated labeler workflow
  Updated .github/workflows/release-notes-check.yml: updated release notes check workflow
========================================================================

       ✅ Migration script finished successfully ✅

Next step

Migration changes were committed and auto-merge-on-changes is disabled. Please review, approve, and merge this PR manually.

Note

If this PR needs rebasing later, comment @dependabot recreate on the PR.
This discards any current PR changes. Dependabot will regenerate the PR from the current base, and this action will detect that the migration commit is gone and re-run the migration on the recreated commit.

---

📋 Full migration logs

[llucax]

Damn. When a PR to update to an older version is reused by dependabot with a newer version, it seems like the dependabot metadata action gets confused and resolves to the old version, not the new one, so we are only migrating to v0.17 instead of v0.18. Will fix manually for now.

[llucax]

• Updated PRs seem to resolved old metadata dependabot/fetch-metadata#728

[llucax]

Done, needs approval from someone else now.