chore: make go-update && make go-tidy & disable dependabot Go updat…

…es (#473)

Dependabot was creating incomplete Go module updates, resulting in problematic PRs: https://github.com/GoogleChrome/webstatus.dev/pulls?q=is%3Apr+is%3Aclosed+label%3Ago

These PRs didn't run go mod tidy or maintain the linkages to sibling modules, leading to unexpected changes in the go.sum lock files and confusion during code review.

This change:

1. Disables Dependabot's automatic Go module updates.
2. Replaces the automatic update with an existing manual process:
  - Run make go-update to update dependencies.
  - Run make go-tidy to ensure the go.sum file is up-to-date and consistent.
This ensures that Go modules are updated consistently and avoids unnecessary changes in the lock file.

It would be great if dependabot allowed us to run custom hooks before creating the PR.

Change-Id: I21a94e607028799b3b7462b316f02c752ba77acb

.github/dependabot.yml

@@ -15,61 +15,8 @@
 version: 2
 updates:
   # Go Modules
-  - package-ecosystem: 'gomod'
-    directory: '/backend'
-    schedule:
-      interval: 'weekly'
-    allow:
-      - dependency-type: all
-
-  - package-ecosystem: 'gomod'
-    directory: '/lib'
-    schedule:
-      interval: 'weekly'
-    allow:
-      - dependency-type: all
-
-  - package-ecosystem: 'gomod'
-    directory: '/lib/gen'
-    schedule:
-      interval: 'weekly'
-    allow:
-      - dependency-type: all
-
-  - package-ecosystem: 'gomod'
-    directory: '/util'
-    schedule:
-      interval: 'weekly'
-    allow:
-      - dependency-type: all
-
-  - package-ecosystem: 'gomod'
-    directory: '/workflows/steps/services/bcd_consumer'
-    schedule:
-      interval: 'weekly'
-    allow:
-      - dependency-type: all
-
-  - package-ecosystem: 'gomod'
-    directory: '/workflows/steps/services/common/repo_downloader'
-    schedule:
-      interval: 'weekly'
-    allow:
-      - dependency-type: all
-
-  - package-ecosystem: 'gomod'
-    directory: '/workflows/steps/services/web_feature_consumer'
-    schedule:
-      interval: 'weekly'
-    allow:
-      - dependency-type: all
-
-  - package-ecosystem: 'gomod'
-    directory: '/workflows/steps/services/wpt_consumer'
-    schedule:
-      interval: 'weekly'
-    allow:
-      - dependency-type: all
+  # TODO - revisit when dependabot has better support for multi-module projects that reference each other.
+  # https://github.com/dependabot/dependabot-core/issues/6012
 
   # NPM
   - package-ecosystem: 'npm'

backend/go.mod

@@ -3,27 +3,27 @@ module github.com/GoogleChrome/webstatus.dev/backend
 go 1.22.0
 
 require (
-	github.com/GoogleChrome/webstatus.dev/lib v0.0.0-20240617233854-afc779445ed9
-	github.com/GoogleChrome/webstatus.dev/lib/gen v0.0.0-00010101000000-000000000000
-	github.com/go-chi/chi/v5 v5.0.14
+	github.com/GoogleChrome/webstatus.dev/lib v0.0.0-20240701145912-944256342539
+	github.com/GoogleChrome/webstatus.dev/lib/gen v0.0.0-20240701145912-944256342539
+	github.com/go-chi/chi/v5 v5.1.0
 	github.com/go-chi/cors v1.2.1
 	github.com/oapi-codegen/runtime v1.1.1
 )
 
 require (
 	cel.dev/expr v0.15.0 // indirect
 	cloud.google.com/go v0.115.0 // indirect
-	cloud.google.com/go/auth v0.5.1 // indirect
+	cloud.google.com/go/auth v0.6.1 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.2 // indirect
-	cloud.google.com/go/cloudtasks v1.12.8 // indirect
-	cloud.google.com/go/compute/metadata v0.3.0 // indirect
+	cloud.google.com/go/cloudtasks v1.12.10 // indirect
+	cloud.google.com/go/compute/metadata v0.4.0 // indirect
 	cloud.google.com/go/datastore v1.17.1 // indirect
-	cloud.google.com/go/iam v1.1.8 // indirect
+	cloud.google.com/go/iam v1.1.10 // indirect
 	cloud.google.com/go/logging v1.10.0 // indirect
-	cloud.google.com/go/longrunning v0.5.7 // indirect
-	cloud.google.com/go/secretmanager v1.13.1 // indirect
-	cloud.google.com/go/spanner v1.63.0 // indirect
-	cloud.google.com/go/trace v1.10.7 // indirect
+	cloud.google.com/go/longrunning v0.5.9 // indirect
+	cloud.google.com/go/secretmanager v1.13.3 // indirect
+	cloud.google.com/go/spanner v1.64.0 // indirect
+	cloud.google.com/go/trace v1.10.9 // indirect
 	github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.24.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v1.24.0 // indirect
@@ -42,8 +42,8 @@ require (
 	github.com/getkin/kin-openapi v0.125.0 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/jsonpointer v0.20.2 // indirect
-	github.com/go-openapi/swag v0.22.8 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/gomodule/redigo v1.9.2 // indirect
@@ -52,22 +52,23 @@ require (
 	github.com/google/s2a-go v0.1.7 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
-	github.com/googleapis/gax-go/v2 v2.12.4 // indirect
+	github.com/googleapis/gax-go/v2 v2.12.5 // indirect
 	github.com/gorilla/handlers v1.5.2 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 // indirect
-	github.com/invopop/yaml v0.2.0 // indirect
+	github.com/invopop/yaml v0.3.1 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/perimeterx/marshmallow v1.1.5 // indirect
 	github.com/prometheus/client_golang v1.19.1 // indirect
 	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.54.0 // indirect
+	github.com/prometheus/common v0.55.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/web-platform-tests/wpt.fyi v0.0.0-20240610182640-eca6121c6932 // indirect
+	github.com/web-platform-tests/wpt.fyi v0.0.0-20240702131824-8417ba51f86d // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/contrib/bridges/prometheus v0.52.0 // indirect
 	go.opentelemetry.io/contrib/detectors/gcp v1.27.0 // indirect
@@ -103,10 +104,10 @@ require (
 	golang.org/x/text v0.16.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
-	google.golang.org/api v0.185.0 // indirect
-	google.golang.org/genproto v0.0.0-20240617180043-68d350f18fd4 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240617180043-68d350f18fd4 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240617180043-68d350f18fd4 // indirect
+	google.golang.org/api v0.187.0 // indirect
+	google.golang.org/genproto v0.0.0-20240701130421-f6361c86f094 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240701130421-f6361c86f094 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 // indirect
 	google.golang.org/grpc v1.64.0 // indirect
 	google.golang.org/protobuf v1.34.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect