From 457221ef74cd5650986f7d118b5bee5d81fb402e Mon Sep 17 00:00:00 2001 From: Zach Borboa Date: Thu, 19 Jun 2025 12:35:31 -0400 Subject: [PATCH] Add workflow to track outdated dependencies (#943) * Clean up * Add workflow to track outdated dependencies * Allow direct and indirect updates for all packages --- .github/dependabot.yml | 2 + .github/outdated.yml | 78 ++++++++++++++++++++ .github/workflows/dependabot-auto-merge.yml | 12 +-- .github/workflows/pre-commit-auto-update.yml | 8 +- 4 files changed, 91 insertions(+), 9 deletions(-) create mode 100644 .github/outdated.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index eb9cfb5..27c9911 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -34,3 +34,5 @@ updates: commit-message: prefix: ⬆ versioning-strategy: "increase" + allow: + - dependency-type: "all" diff --git a/.github/outdated.yml b/.github/outdated.yml new file mode 100644 index 0000000..aba77af --- /dev/null +++ b/.github/outdated.yml @@ -0,0 +1,78 @@ +name: Track outdated dependencies + +on: + schedule: + - cron: '0 18 * * 1-4' + workflow_dispatch: + +jobs: + run: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + persist-credentials: false + + - name: Install requirements + run: | + python -m pip install --upgrade pip + pip install --requirement scripts/make_release_requirements.txt + + - name: Update outdated dependencies + id: check-outdated + run: | + set -x + outdated="$(pip list --outdated --format json | jq)" + outdated_count="$(echo "$outdated" | jq 'length')" + echo "${outdated}" | jq "[{\"outdated_count\":\"${outdated_count}\"}] + ." > scripts/make_release_requirements.json + git diff --color + changes="$(git diff)" + delimiter="$(openssl rand -hex 8)" + echo "changes<<${delimiter}" >> "${GITHUB_OUTPUT}" + echo "${changes}" >> "${GITHUB_OUTPUT}" + echo "${delimiter}" >> "${GITHUB_OUTPUT}" + + - name: Create or update pull request + id: cpr + uses: peter-evans/create-pull-request@v7 + with: + commit-message: Update outdated dependencies list + labels: dependencies + title: "Chore: Update outdated dependencies list" + body: | + ```diff + ${{ steps.check-outdated.outputs.changes }} + ``` + branch: create-pull-request/outdated + author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> + committer: GitHub + + - name: Pull request created or updated + if: ${{ steps.cpr.outputs.pull-request-number }} + run: | + echo "Pull request: ${{ steps.cpr.outputs.pull-request-url }}" + + - name: Approve outdated dependencies pull request + if: ${{ steps.cpr.outputs.pull-request-number }} + run: | + review_status="$( + gh pr view "${PR_URL}" \ + --json="reviewDecision" \ + --jq=".reviewDecision" + )" + echo "Pull request review status: ${review_status}" + if [[ "${review_status}" != "APPROVED" ]]; then + gh pr review --approve "${PR_URL}" + fi + env: + PR_URL: ${{ steps.cpr.outputs.pull-request-url }} + GITHUB_TOKEN: ${{ secrets.PHP_CURL_CLASS_TOKEN }} + + - name: Enable auto-merge for outdated dependencies pull request + if: ${{ steps.cpr.outputs.pull-request-number }} + run: | + gh pr merge --auto --merge "${PR_URL}" + env: + PR_URL: ${{ steps.cpr.outputs.pull-request-url }} + GITHUB_TOKEN: ${{ secrets.PHP_CURL_CLASS_TOKEN }} \ No newline at end of file diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 2f890dc..a5ba44b 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -18,15 +18,15 @@ jobs: - name: Approve and label updates run: | review_status="$( - gh pr view "$PR_URL" \ + gh pr view "${PR_URL}" \ --json="reviewDecision" \ --jq=".reviewDecision" )" echo "Pull request review status: ${review_status}" if [[ "${review_status}" != "APPROVED" ]]; then - gh pr review --approve "$PR_URL" + gh pr review --approve "${PR_URL}" fi - gh pr edit --add-label "cleanup-no-release-required" "$PR_URL" + gh pr edit --add-label "cleanup-no-release-required" "${PR_URL}" env: PR_URL: ${{ github.event.pull_request.html_url }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -34,7 +34,7 @@ jobs: - name: Merge Dependabot patch updates if: ${{ steps.dependabot-metadata.outputs.update-type == 'version-update:semver-patch' }} run: | - gh pr merge --auto --merge "$PR_URL" + gh pr merge --auto --merge "${PR_URL}" env: PR_URL: ${{ github.event.pull_request.html_url }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -42,7 +42,7 @@ jobs: - name: Merge Dependabot minor updates if: ${{ steps.dependabot-metadata.outputs.update-type == 'version-update:semver-minor' }} run: | - gh pr merge --auto --merge "$PR_URL" + gh pr merge --auto --merge "${PR_URL}" env: PR_URL: ${{ github.event.pull_request.html_url }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -50,7 +50,7 @@ jobs: - name: Merge Dependabot indirect dependency updates if: ${{ steps.dependabot-metadata.outputs.dependency-type == 'indirect' }} run: | - gh pr merge --auto --merge "$PR_URL" + gh pr merge --auto --merge "${PR_URL}" env: PR_URL: ${{ github.event.pull_request.html_url }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/pre-commit-auto-update.yml b/.github/workflows/pre-commit-auto-update.yml index 26ad84a..50f3e0c 100644 --- a/.github/workflows/pre-commit-auto-update.yml +++ b/.github/workflows/pre-commit-auto-update.yml @@ -62,21 +62,23 @@ jobs: set -x gh repo set-default php-curl-class/php-curl-class gh repo set-default --view - gh pr merge --auto --merge "${{ steps.cpr.outputs.pull-request-url }}" + gh pr merge --auto --merge "${PR_URL}" env: + PR_URL: ${{ steps.cpr.outputs.pull-request-url }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Approve update if: ${{ steps.cpr.outputs.pull-request-number }} run: | review_status="$( - gh pr view "${{ steps.cpr.outputs.pull-request-url }}" \ + gh pr view "${PR_URL}" \ --json="reviewDecision" \ --jq=".reviewDecision" )" echo "Pull request review status: ${review_status}" if [[ "${review_status}" != "APPROVED" ]]; then - gh pr review --approve "${{ steps.cpr.outputs.pull-request-url }}" + gh pr review --approve "${PR_URL}" fi env: + PR_URL: ${{ steps.cpr.outputs.pull-request-url }} GITHUB_TOKEN: ${{ secrets.PHP_CURL_CLASS_TOKEN }}