Update lockfiles #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update lockfiles | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| # Weekly Monday 06:00 UTC | |
| - cron: "0 6 * * 1" | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| update-lockfiles: | |
| name: Update dependency lockfiles | |
| permissions: | |
| contents: write # push lockfile updates | |
| pull-requests: write # create lockfile update PR | |
| runs-on: ubuntu-latest | |
| environment: release | |
| steps: | |
| - name: Compute target branch + mode | |
| id: target | |
| shell: bash | |
| env: | |
| GH_EVENT_NAME: ${{ github.event_name }} | |
| GH_REF_NAME: ${{ github.ref_name }} | |
| run: | | |
| set -euo pipefail | |
| if [ "$GH_EVENT_NAME" = "schedule" ]; then | |
| echo "branch=main" >> "$GITHUB_OUTPUT" | |
| echo "mode=pr" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| echo "branch=$GH_REF_NAME" >> "$GITHUB_OUTPUT" | |
| if [ "$GH_REF_NAME" = "main" ]; then | |
| echo "mode=pr" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "mode=push" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ steps.target.outputs.branch }} | |
| persist-credentials: false | |
| - name: Generate release token | |
| id: app-token | |
| uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3 | |
| with: | |
| app-id: ${{ vars.RELEASE_APP_ID }} | |
| private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 | |
| with: | |
| enable-cache: true | |
| python-version: "3.10" | |
| - name: Update lockfile | |
| run: uv lock -U | |
| - name: Commit and push to feature branch | |
| if: steps.target.outputs.mode == 'push' | |
| shell: bash | |
| env: | |
| APP_TOKEN: ${{ steps.app-token.outputs.token }} | |
| REPO: ${{ github.repository }} | |
| run: | | |
| set -euo pipefail | |
| if [ -z "$(git status --porcelain)" ]; then | |
| echo "No changes to commit." | |
| exit 0 | |
| fi | |
| git config user.name "lockfile-bot" | |
| git config user.email "lockfile-bot@users.noreply.github.com" | |
| git add uv.lock | |
| git commit -m "chore: update lockfiles" | |
| git remote set-url origin "https://x-access-token:${APP_TOKEN}@github.com/${REPO}.git" | |
| git push origin HEAD | |
| - name: Create Pull Request # zizmor: ignore[superfluous-actions] | |
| if: steps.target.outputs.mode == 'pr' | |
| uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0 | |
| with: | |
| token: ${{ steps.app-token.outputs.token }} | |
| branch: chore/lock-update-${{ steps.target.outputs.branch }} | |
| base: ${{ steps.target.outputs.branch }} | |
| title: "chore: update lockfiles" | |
| commit-message: "chore: update lockfiles" | |
| labels: | | |
| lock update |