Add workflow to track outdated dependencies (#943)

* Clean up

* Add workflow to track outdated dependencies

* Allow direct and indirect updates for all packages

.github/dependabot.yml

@@ -34,3 +34,5 @@ updates:
     commit-message:
       prefix: ⬆
     versioning-strategy: "increase"
+    allow:
+      - dependency-type: "all"

.github/outdated.yml

@@ -0,0 +1,78 @@
+name: Track outdated dependencies
+
+on:
+  schedule:
+    - cron: '0 18 * * 1-4'
+  workflow_dispatch:
+
+jobs:
+  run:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+            persist-credentials: false
+
+      - name: Install requirements
+        run: |
+          python -m pip install --upgrade pip
+          pip install --requirement scripts/make_release_requirements.txt
+
+      - name: Update outdated dependencies
+        id: check-outdated
+        run: |
+          set -x
+          outdated="$(pip list --outdated --format json | jq)"
+          outdated_count="$(echo "$outdated" | jq 'length')"
+          echo "${outdated}" | jq "[{\"outdated_count\":\"${outdated_count}\"}] + ." > scripts/make_release_requirements.json
+          git diff --color
+          changes="$(git diff)"
+          delimiter="$(openssl rand -hex 8)"
+          echo "changes<<${delimiter}" >> "${GITHUB_OUTPUT}"
+          echo "${changes}" >> "${GITHUB_OUTPUT}"
+          echo "${delimiter}" >> "${GITHUB_OUTPUT}"
+
+      - name: Create or update pull request
+        id: cpr
+        uses: peter-evans/create-pull-request@v7
+        with:
+          commit-message: Update outdated dependencies list
+          labels: dependencies
+          title: "Chore: Update outdated dependencies list"
+          body: |
+            ```diff
+            ${{ steps.check-outdated.outputs.changes }}
+            ```
+          branch: create-pull-request/outdated
+          author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
+          committer: GitHub <noreply@github.com>
+
+      - name: Pull request created or updated
+        if: ${{ steps.cpr.outputs.pull-request-number }}
+        run: |
+          echo "Pull request: ${{ steps.cpr.outputs.pull-request-url }}"
+
+      - name: Approve outdated dependencies pull request
+        if: ${{ steps.cpr.outputs.pull-request-number }}
+        run: |
+          review_status="$(
+              gh pr view "${PR_URL}" \
+                  --json="reviewDecision" \
+                  --jq=".reviewDecision"
+          )"
+          echo "Pull request review status: ${review_status}"
+          if [[ "${review_status}" != "APPROVED" ]]; then
+              gh pr review --approve "${PR_URL}"
+          fi
+        env:
+          PR_URL: ${{ steps.cpr.outputs.pull-request-url }}
+          GITHUB_TOKEN: ${{ secrets.PHP_CURL_CLASS_TOKEN }}
+
+      - name: Enable auto-merge for outdated dependencies pull request
+        if: ${{ steps.cpr.outputs.pull-request-number }}
+        run: |
+          gh pr merge --auto --merge "${PR_URL}"
+        env:
+          PR_URL: ${{ steps.cpr.outputs.pull-request-url }}
+          GITHUB_TOKEN: ${{ secrets.PHP_CURL_CLASS_TOKEN }}

.github/workflows/dependabot-auto-merge.yml

@@ -18,15 +18,15 @@ jobs:
       - name: Approve and label updates
         run: |
           review_status="$(
-              gh pr view "$PR_URL" \
+              gh pr view "${PR_URL}" \
                   --json="reviewDecision" \
                   --jq=".reviewDecision"
           )"
           echo "Pull request review status: ${review_status}"
           if [[ "${review_status}" != "APPROVED" ]]; then
-              gh pr review --approve "$PR_URL"
+              gh pr review --approve "${PR_URL}"
           fi
-          gh pr edit --add-label "cleanup-no-release-required" "$PR_URL"
+          gh pr edit --add-label "cleanup-no-release-required" "${PR_URL}"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -34,7 +34,7 @@ jobs:
       - name: Merge Dependabot patch updates
         if: ${{ steps.dependabot-metadata.outputs.update-type == 'version-update:semver-patch' }}
         run: |
-          gh pr merge --auto --merge "$PR_URL"
+          gh pr merge --auto --merge "${PR_URL}"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -42,7 +42,7 @@ jobs:
       - name: Merge Dependabot minor updates
         if: ${{ steps.dependabot-metadata.outputs.update-type == 'version-update:semver-minor' }}
         run: |
-          gh pr merge --auto --merge "$PR_URL"
+          gh pr merge --auto --merge "${PR_URL}"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -50,7 +50,7 @@ jobs:
       - name: Merge Dependabot indirect dependency updates
         if: ${{ steps.dependabot-metadata.outputs.dependency-type == 'indirect' }}
         run: |
-          gh pr merge --auto --merge "$PR_URL"
+          gh pr merge --auto --merge "${PR_URL}"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pre-commit-auto-update.yml

@@ -62,21 +62,23 @@ jobs:
           set -x
           gh repo set-default php-curl-class/php-curl-class
           gh repo set-default --view
-          gh pr merge --auto --merge "${{ steps.cpr.outputs.pull-request-url }}"
+          gh pr merge --auto --merge "${PR_URL}"
         env:
+          PR_URL: ${{ steps.cpr.outputs.pull-request-url }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Approve update
         if: ${{ steps.cpr.outputs.pull-request-number }}
         run: |
           review_status="$(
-              gh pr view "${{ steps.cpr.outputs.pull-request-url }}" \
+              gh pr view "${PR_URL}" \
                   --json="reviewDecision" \
                   --jq=".reviewDecision"
           )"
           echo "Pull request review status: ${review_status}"
           if [[ "${review_status}" != "APPROVED" ]]; then
-              gh pr review --approve "${{ steps.cpr.outputs.pull-request-url }}"
+              gh pr review --approve "${PR_URL}"
           fi
         env:
+          PR_URL: ${{ steps.cpr.outputs.pull-request-url }}
           GITHUB_TOKEN: ${{ secrets.PHP_CURL_CLASS_TOKEN }}