Trimming for long-term storage

[therealryan]

This project has a few wee bits that need tiny amounts of regular attention:

• Dependabot will create a bunch of PRs to update dependencies every Monday morning - these need to be manually reviewed and approved/rejected as appropriate
• We use an instance of bowlby to avoid dealing with build artifact zips, but that instance runs on external infrastructure with perishable components (SSL certs, API access token, the VM)

This PR preps the project for periods of low maintenance capacity by:

• Deleting the dependabot config. Our dependencies will go stale, but that's better than having really boring PRs stacking up.
• Dropping usage of the bowlby instance. We're then stuck downloading zips like savages, but that's better than having dead links.

#968 is the other half of this, and should be merged at the same time.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[therealryan]

@vchaitanya Hi again!

It might be time to take action on the bowlby links - github has just notified me that the access token expires on 24/09/25. After that date I suspect the links on the build artifact page and build summaries (for example) will no longer work
I don't have access rights to this project any more, so I can't generate a new token with the correct scope.

I think your options are to either:

• Use some of the changes in this PR and Trimming for long-term storage #968 to remove the bowlby integration entirely. N.B.: you should not remove the dependabot config
• Bring up your own instance of bowlby and update the integration to use it instead. I'm running the current instance on an always-free-tier oracle cloud vm. It wasn't too hard to set up.

If you go for option 1 then let me know and I'll take down the current instance.
Happy to answer questions if you have any!

Cheers!

[therealryan]

Actually, it turns out that the notification email had a link that let me generate an equivalent token, so I've done that and updated the bowlby instance to use it instead. The links should be good for the foreseeable future.

Panic over!

[vchaitanya]

Actually, it turns out that the notification email had a link that let me generate an equivalent token, so I've done that and updated the bowlby instance to use it instead. The links should be good for the foreseeable future.

Panic over!

Thanks a lot for looking into this Ryan.