Turn off the dependabot for npm / package.yaml

[andreasabel]

It does not properly regenerate the files, and breaks the sync between
lib/ and dist/.
This breaks an invariant that is checked in our CI:

setup/.github/workflows/workflow.yml

Lines 34 to 35 in e9c043c

	- name: Ensure generated files are up-to-date
	run: git diff --exit-code dist/ lib/

Closes #33.

[andreasabel]

@brandonchinn178 @mihaimaruseac
Maybe it is best to turn off dependabot. Since it wants to update each dep individually, it has a quadratic load on the CI: Say it wants to merge 6 updates, after one merges the first one, CI runs again for the other 5, etc.

We can update the deps manually, it seems by this command sequence:

ncu -u
npm install
git add package.yaml package.yaml.lock
git commit -m "Update dependencies"
gh pr create --fill
# When CI is successful, merge the PR

(The last two command kick off the respective husky scripts.)

This could be done once in a while.

[brandonchinn178]

That makes sense to me!

[mihaimaruseac]

Makes sense to me too.

I know there's an option to configure dependabot / renovate to update all deps at once in a single pass. If we can do that's also a good solution to keep up to date.

[andreasabel]

dependabot groups: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#groups

[andreasabel]

Merged as c06cff5.