Allow renovatebot to freshen template dependencies

Currently we explicitly exclude the template directory from renovatebot's config because it can't parse the templated pyproject.toml. Consider finding some way in which template/pyproject.toml is still valid TOML while also being able to be parsed by renovatebot.

Related to this: It will be useful to validate CI dependencies as well, like: https://gitlab.developers.cam.ac.uk/uis/devops/webapp-boilerplate/-/blob/master/template/.gitlab/webapp.gitlab-ci.yml?ref_type=heads#L13 which I don't think they are being checked either.

It's worth noting that we don't ship a poetry.lock file and instead generate it at template creation time and so, within the version specifiers in pyproject.toml, we will always get the freshest dependencies. Also, once generated, renovatebot will be able to see and update dependencies.

One strategy might be to lean in to the post-generation scripts a bit more, have an untemplated pyproject.toml file and instead edit it programmatically via a script after generation. Or we could have a list of requirements which renovatebot can see which is interpolated in at generation time. For example, we could have a template-requirements.txt file in the top-level which contains requirements for the template, have copier load those at generation time and interpolate into pyproject.yaml and .gitlab/webapp.gitlab-ci.yaml at generation time.

I'm picking this up to do some experimentation.

added teamDeveloper Experience workflowIn Progress labels

assigned to @rjw57

mentioned in commit 0bf1f9a2

mentioned in merge request !103 (merged)

mentioned in commit 5e998990

changed due date to April 01, 2025

OK, !103 (merged) merged to test renovatebot's powers. Mostly things seem good with the exception of

I think renovatebot should've managed to find that thanks to --index-url so I'll do some renovatebot docs-diving to work out what happened there. Otherwise, other things look good for having renovate be able to bump dependencies.

Fixed in a8f2a7f3 and subsequent smoke-testing seems to indicate that this is working.

closed