Skip to content

Commit 9d676ed

Browse files
lesebleseb
authored
ci(dependabot): add dependency scanning for ogx-api package (#5947)
# What does this PR do? The `ogx-api` package (`src/ogx_api/`) has its own `pyproject.toml` and `uv.lock` but was not covered by Dependabot. This adds scanning for it and updates the constraint-update workflows to handle both packages. Changes: - Add a new `uv` ecosystem entry in `dependabot.yml` for `/src/ogx_api` with `chore(api-deps)` prefix - Update `dependabot-constraints.yml` to run the constraint update script against both `pyproject.toml` files, regenerate both lock files, and include the API package files in the artifact - Update `commit-constraint-updates.yml` to copy, stage, and commit the API package's `pyproject.toml` and `uv.lock` alongside the root files ## Test Plan 1. Verify the three modified workflow files parse correctly (pre-commit `check yaml` and `Lint GitHub Actions workflow files` both pass) 2. On the next Dependabot PR for a shared dependency (e.g. `pydantic`, `openai`), confirm the constraint-dependencies workflow updates both `pyproject.toml` files and regenerates both `uv.lock` files <!-- devin-review-badge-begin --> --- <a href="https://app.devin.ai/review/ogx-ai/ogx/pull/5947" target="_blank"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1"> <img src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1" alt="Open in Devin Review"> </picture> </a> <!-- devin-review-badge-end --> --------- Signed-off-by: Sébastien Han <seb@redhat.com>
1 parent bb63ea6 commit 9d676ed

3 files changed

Lines changed: 83 additions & 16 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,17 @@ updates:
2121
commit-message:
2222
prefix: chore(python-deps)
2323

24+
- package-ecosystem: "uv"
25+
directory: "/src/ogx_api"
26+
schedule:
27+
interval: "weekly"
28+
day: "saturday"
29+
labels:
30+
- type/dependencies
31+
- python
32+
commit-message:
33+
prefix: chore(api-deps)
34+
2435
- package-ecosystem: npm
2536
directory: "/ogx_ui"
2637
schedule:

‎.github/workflows/commit-constraint-updates.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -217,6 +217,14 @@ jobs:
217217
cp constraint-update/uv.lock uv.lock
218218
echo "Copied updated uv.lock"
219219
fi
220+
if [ -f constraint-update/src/ogx_api/pyproject.toml ]; then
221+
cp constraint-update/src/ogx_api/pyproject.toml src/ogx_api/pyproject.toml
222+
echo "Copied updated src/ogx_api/pyproject.toml"
223+
fi
224+
if [ -f constraint-update/src/ogx_api/uv.lock ]; then
225+
cp constraint-update/src/ogx_api/uv.lock src/ogx_api/uv.lock
226+
echo "Copied updated src/ogx_api/uv.lock"
227+
fi
220228
221229
- name: Commit and push constraint updates
222230
id: commit
@@ -233,13 +241,13 @@ jobs:
233241
git config user.name "github-actions[bot]"
234242
git config user.email "github-actions[bot]@users.noreply.github.com"
235243
236-
if [[ -z $(git status --porcelain pyproject.toml uv.lock) ]]; then
244+
if [[ -z $(git status --porcelain pyproject.toml uv.lock src/ogx_api/pyproject.toml src/ogx_api/uv.lock) ]]; then
237245
echo "No changes to commit"
238246
echo "pushed=false" >> "$GITHUB_OUTPUT"
239247
exit 0
240248
fi
241249
242-
git add pyproject.toml uv.lock
250+
git add pyproject.toml uv.lock src/ogx_api/pyproject.toml src/ogx_api/uv.lock
243251
git commit -s -m "fix(deps): update constraint-dependencies for ${DEP_NAME}"
244252
245253
if [ "$IS_FORK_PR" = "true" ]; then

‎.github/workflows/dependabot-constraints.yml‎

Lines changed: 62 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ on:
1515
pull_request:
1616
paths:
1717
- 'uv.lock'
18+
- 'src/ogx_api/uv.lock'
1819

1920
concurrency:
2021
group: ${{ github.workflow }}-${{ github.head_ref }}
@@ -68,28 +69,67 @@ jobs:
6869
} >> "$GITHUB_OUTPUT"
6970
echo "Parsed: $dep_name $dep_version"
7071
71-
- name: Update dependency version floors in pyproject.toml
72+
- name: Determine target pyproject from changed lock files
7273
if: steps.parse.outputs.skip != 'true'
74+
id: target
75+
run: |
76+
pyprojects=""
77+
if git diff HEAD~1 --name-only | grep -q '^uv\.lock$'; then
78+
pyprojects="pyproject.toml"
79+
fi
80+
if git diff HEAD~1 --name-only | grep -q '^src/ogx_api/uv\.lock$'; then
81+
pyprojects="$pyprojects src/ogx_api/pyproject.toml"
82+
fi
83+
pyprojects=$(echo "$pyprojects" | xargs)
84+
85+
if [ -z "$pyprojects" ]; then
86+
echo "No lock file changes detected, skipping"
87+
echo "skip=true" >> "$GITHUB_OUTPUT"
88+
else
89+
echo "Target pyproject files: $pyprojects"
90+
echo "pyprojects=$pyprojects" >> "$GITHUB_OUTPUT"
91+
echo "skip=false" >> "$GITHUB_OUTPUT"
92+
fi
93+
94+
- name: Update dependency version floors in pyproject.toml
95+
if: steps.parse.outputs.skip != 'true' && steps.target.outputs.skip != 'true'
7396
id: update
7497
env:
7598
DEP_NAME: ${{ steps.parse.outputs.dep_name }}
7699
DEP_VERSION: ${{ steps.parse.outputs.dep_version }}
100+
TARGET_PYPROJECTS: ${{ steps.target.outputs.pyprojects }}
77101
run: |
78-
output=$(python3 .github/scripts/update_constraint_deps.py \
79-
--dependency-name "$DEP_NAME" \
80-
--dependency-version "$DEP_VERSION")
102+
changed=false
81103
82-
echo "$output"
104+
for pyproject in $TARGET_PYPROJECTS; do
105+
echo "--- Checking $pyproject ---"
106+
output=$(python3 .github/scripts/update_constraint_deps.py \
107+
--dependency-name "$DEP_NAME" \
108+
--dependency-version "$DEP_VERSION" \
109+
--pyproject "$pyproject")
83110
84-
if echo "$output" | grep -q "updated=true"; then
85-
echo "changed=true" >> "$GITHUB_OUTPUT"
86-
else
87-
echo "changed=false" >> "$GITHUB_OUTPUT"
88-
fi
111+
echo "$output"
112+
113+
if echo "$output" | grep -q "updated=true"; then
114+
changed=true
115+
fi
116+
done
117+
118+
echo "changed=$changed" >> "$GITHUB_OUTPUT"
89119
90-
- name: Regenerate uv.lock
120+
- name: Regenerate uv.lock files
91121
if: steps.update.outputs.changed == 'true'
92-
run: uv lock
122+
env:
123+
TARGET_PYPROJECTS: ${{ steps.target.outputs.pyprojects }}
124+
run: |
125+
if echo " $TARGET_PYPROJECTS " | grep -q ' pyproject.toml '; then
126+
echo "Regenerating root uv.lock"
127+
uv lock
128+
fi
129+
if echo " $TARGET_PYPROJECTS " | grep -q ' src/ogx_api/pyproject.toml '; then
130+
echo "Regenerating src/ogx_api/uv.lock"
131+
uv lock --directory src/ogx_api
132+
fi
93133
94134
- name: Create PR metadata artifact
95135
if: steps.parse.outputs.skip != 'true'
@@ -132,6 +172,7 @@ jobs:
132172
CHANGED: ${{ steps.update.outputs.changed }}
133173
DEP_NAME: ${{ steps.parse.outputs.dep_name }}
134174
DEP_VERSION: ${{ steps.parse.outputs.dep_version }}
175+
TARGET_PYPROJECTS: ${{ steps.target.outputs.pyprojects }}
135176
run: |
136177
mkdir -p constraint-update
137178
cat > constraint-update/change-info.json <<EOF
@@ -143,8 +184,15 @@ jobs:
143184
EOF
144185
145186
if [ "$CHANGED" = "true" ]; then
146-
cp pyproject.toml constraint-update/
147-
cp uv.lock constraint-update/
187+
if echo " $TARGET_PYPROJECTS " | grep -q ' pyproject.toml '; then
188+
cp pyproject.toml constraint-update/
189+
cp uv.lock constraint-update/
190+
fi
191+
if echo " $TARGET_PYPROJECTS " | grep -q ' src/ogx_api/pyproject.toml '; then
192+
mkdir -p constraint-update/src/ogx_api
193+
cp src/ogx_api/pyproject.toml constraint-update/src/ogx_api/
194+
cp src/ogx_api/uv.lock constraint-update/src/ogx_api/
195+
fi
148196
fi
149197
150198
- name: Upload constraint update

0 commit comments

Comments
 (0)