From 3490d53c55c39b9cc0b087c3d5b9510118133aea Mon Sep 17 00:00:00 2001
From: "Daniel A. Wozniak" <dwozniak@broadcom.com>
Date: Tue, 26 May 2026 18:59:55 -0700
Subject: [PATCH 1/2] Automate dependency updates and releases

---
 .github/workflows/auto-release.yml         | 22 +++++++
 .github/workflows/auto-update-versions.yml | 74 ++++++++++++++++++++++
 2 files changed, 96 insertions(+)
 create mode 100644 .github/workflows/auto-release.yml
 create mode 100644 .github/workflows/auto-update-versions.yml

diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
new file mode 100644
index 00000000..598fbc1d
--- /dev/null
+++ b/.github/workflows/auto-release.yml
@@ -0,0 +1,22 @@
+name: Auto-Release
+
+on:
+  pull_request:
+    types:
+      - closed
+    branches:
+      - main
+
+jobs:
+  ci:
+    if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'automated-update')
+    name: Build and Release
+    permissions:
+      contents: write
+      pull-requests: read
+      id-token: write
+    uses: ./.github/workflows/ci.yml
+    with:
+      kind: "release"
+    secrets:
+      PRIVATE_KEY: ${{ secrets.PRIVATE_KEY }}
\ No newline at end of file
diff --git a/.github/workflows/auto-update-versions.yml b/.github/workflows/auto-update-versions.yml
new file mode 100644
index 00000000..bd3c4aba
--- /dev/null
+++ b/.github/workflows/auto-update-versions.yml
@@ -0,0 +1,74 @@
+name: Auto-Update Versions
+
+on:
+  schedule:
+    - cron: '0 2 * * 1' # Run every Monday at 2am UTC
+  workflow_dispatch:
+
+jobs:
+  update-versions:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate App Token
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install Dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .
+
+      - name: Run Update Commands
+        id: update
+        run: |
+          python3 -m relenv versions --update-deps
+          python3 -m relenv versions --update
+          
+          if git diff --quiet relenv/python-versions.json; then
+            echo "changed=false" >> $GITHUB_OUTPUT
+          else
+            echo "changed=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Generate Changelog Entry
+        if: steps.update.outputs.changed == 'true'
+        run: |
+          mkdir -p changelog
+          ENTRY_FILE="changelog/$(date +%Y%m%d%H%M%S).improvement.rst"
+          echo "Automated version updates for Python and dependencies." > "$ENTRY_FILE"
+
+      - name: Create Pull Request
+        if: steps.update.outputs.changed == 'true'
+        id: cpr
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          commit-message: "chore: update python and dependency versions"
+          title: "Automated Version Updates"
+          body: |
+            This is an automated Pull Request to update the versions of Python and/or bundled dependencies in `python-versions.json`.
+            
+            This PR will be automatically merged if CI passes, and a release will be triggered.
+          branch: "auto-update-versions"
+          base: "main"
+          delete-branch: true
+          labels: "automated-update"
+          
+      - name: Enable Auto-Merge
+        if: steps.update.outputs.changed == 'true' && steps.cpr.outputs.pull-request-number != ''
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh pr merge ${{ steps.cpr.outputs.pull-request-number }} --auto --squash

From f715b6a5a4d568054c341e3828e781c488b1c498 Mon Sep 17 00:00:00 2001
From: "Daniel A. Wozniak" <dwozniak@broadcom.com>
Date: Wed, 27 May 2026 15:11:08 -0700
Subject: [PATCH 2/2] Support both .txt and .lock for Salt static requirements

---
 tests/test_verify_build.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tests/test_verify_build.py b/tests/test_verify_build.py
index ab42d96f..76d73766 100644
--- a/tests/test_verify_build.py
+++ b/tests/test_verify_build.py
@@ -396,6 +396,8 @@ def test_pip_install_salt_w_package_requirements(pipexec, pyexec, tmp_path, salt
         f"py{build_version.rsplit('.', 1)[0]}",
         f"{reqfile}.txt",
     )
+    if not os.path.exists(req):
+        req = req.replace(".txt", ".lock")
     p = subprocess.run(
         [
             str(pipexec),