update-lockfiles.yml

name: Update lockfiles

on:
  workflow_dispatch:
  schedule:
    # Weekly Monday 06:00 UTC
    - cron: "0 6 * * 1"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  update-lockfiles:
    name: Update dependency lockfiles
    permissions:
      contents: write # push lockfile updates
      pull-requests: write # create lockfile update PR
    runs-on: ubuntu-latest
    environment: release
    steps:
      - name: Compute target branch + mode
        id: target
        shell: bash
        env:
          GH_EVENT_NAME: ${{ github.event_name }}
          GH_REF_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          if [ "$GH_EVENT_NAME" = "schedule" ]; then
            echo "branch=main" >> "$GITHUB_OUTPUT"
            echo "mode=pr" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          echo "branch=$GH_REF_NAME" >> "$GITHUB_OUTPUT"
          if [ "$GH_REF_NAME" = "main" ]; then
            echo "mode=pr" >> "$GITHUB_OUTPUT"
          else
            echo "mode=push" >> "$GITHUB_OUTPUT"
          fi

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
          ref: ${{ steps.target.outputs.branch }}
          persist-credentials: false

      - name: Generate release token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        with:
          app-id: ${{ vars.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
          permission-contents: write # push lockfile branch
          permission-pull-requests: write # open lockfile update PR

      - name: Install uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          enable-cache: true
          python-version: "3.10"

      - name: Update lockfile
        run: uv lock -U

      - name: Commit and push to feature branch
        if: steps.target.outputs.mode == 'push'
        shell: bash
        env:
          APP_TOKEN: ${{ steps.app-token.outputs.token }}
          REPO: ${{ github.repository }}
        run: |
          set -euo pipefail
          if [ -z "$(git status --porcelain)" ]; then
            echo "No changes to commit."
            exit 0
          fi
          git config user.name "lockfile-bot"
          git config user.email "lockfile-bot@users.noreply.github.com"
          git add uv.lock
          git commit -m "chore: update lockfiles"
          git remote set-url origin "https://x-access-token:${APP_TOKEN}@github.com/${REPO}.git"
          git push origin HEAD

      - name: Create Pull Request # zizmor: ignore[superfluous-actions]
        if: steps.target.outputs.mode == 'pr'
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          token: ${{ steps.app-token.outputs.token }}
          branch: chore/lock-update-${{ steps.target.outputs.branch }}
          base: ${{ steps.target.outputs.branch }}
          title: "chore: update lockfiles"
          commit-message: "chore: update lockfiles"
          labels: |
            lock update