Update dependency lockfiles #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update dependency lockfiles | |
| on: | |
| schedule: | |
| - cron: '0 4 * * *' | |
| workflow_dispatch: | |
| permissions: {} | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| update-lockfiles: | |
| runs-on: ubuntu-latest | |
| env: | |
| BRANCH: automated/update-lockfiles-${{ github.ref_name }} | |
| WORKFLOW_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| token: ${{ secrets.RELEASE_TOKEN }} | |
| persist-credentials: false | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | |
| with: | |
| python-version: 3.12 | |
| enable-cache: false | |
| - name: Regenerate lockfiles | |
| run: uv run build/gen_lockfile.py | |
| - name: Check for changes | |
| id: changes | |
| run: | | |
| if git diff --quiet distribution/requirements-lock.txt distribution/requirements-lock-konflux.txt; then | |
| echo "changed=false" >> "$GITHUB_OUTPUT" | |
| echo "No lockfile changes detected" | |
| else | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| echo "Lockfile changes detected" | |
| fi | |
| - name: Close stale PR if no changes | |
| if: steps.changes.outputs.changed == 'false' | |
| env: | |
| GH_TOKEN: ${{ secrets.RELEASE_TOKEN }} | |
| run: | | |
| PR_URL=$(gh pr list --head "$BRANCH" --state open --json url --jq '.[0].url' 2>/dev/null || echo "") | |
| if [ -n "$PR_URL" ]; then | |
| gh pr close "$BRANCH" --comment "Lockfiles are now up to date with \`main\`. Closing this PR." | |
| git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" | |
| git push origin --delete "$BRANCH" 2>/dev/null || true | |
| echo "Closed stale PR and deleted branch" | |
| fi | |
| - name: Configure git user | |
| if: steps.changes.outputs.changed == 'true' | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| - name: Create branch and push | |
| if: steps.changes.outputs.changed == 'true' | |
| env: | |
| RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }} | |
| run: | | |
| git checkout -B "$BRANCH" | |
| git add distribution/requirements-lock.txt distribution/requirements-lock-konflux.txt | |
| git diff --cached --quiet && { echo "No changes to commit"; exit 0; } | |
| git commit -m "chore: update dependency lockfiles" | |
| git remote set-url origin "https://x-access-token:${RELEASE_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" | |
| git push --force origin "$BRANCH" | |
| - name: Create or update pull request | |
| if: steps.changes.outputs.changed == 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.RELEASE_TOKEN }} | |
| run: | | |
| PR_URL=$(gh pr list --head "$BRANCH" --state open --json url --jq '.[0].url' 2>/dev/null || echo "") | |
| BODY=$(cat <<EOF | |
| ## Automated lockfile update | |
| > [!WARNING] | |
| > This PR is auto-generated. Do not request changes from the author - push | |
| > changes directly if necessary. | |
| This PR regenerates the pinned dependency lockfiles to pick up upstream package changes. | |
| ### Updated files | |
| - \`distribution/requirements-lock.txt\` | |
| - \`distribution/requirements-lock-konflux.txt\` | |
| > This PR was auto-generated by the [update-lockfiles workflow](${WORKFLOW_URL}). | |
| > Review the dependency changes and merge when ready. | |
| EOF | |
| ) | |
| if [ -n "$PR_URL" ]; then | |
| gh pr edit "$BRANCH" --body "$BODY" | |
| echo "Updated existing PR: $PR_URL" | |
| else | |
| gh pr create \ | |
| --title "chore: update dependency lockfiles" \ | |
| --body "$BODY" \ | |
| --head "$BRANCH" \ | |
| --base "${{ github.ref_name }}" | |
| fi | |
| - name: Notify Slack on failure | |
| if: failure() | |
| env: | |
| SLACK_WEBHOOK_URL: ${{ secrets.WH_SLACK_TEAM_LLS_CORE }} | |
| run: | | |
| TIMESTAMP=$(date -u +%Y-%m-%dT%H:%M:%SZ) | |
| TEXT=$(printf '%s\n%s\n%s' \ | |
| ":failed: *Lockfile generation failed* - [${TIMESTAMP}]" \ | |
| "Nightly lockfile update could not complete" \ | |
| "<${WORKFLOW_URL}|View workflow run>") | |
| bash .github/actions/notify-slack/notify.sh "$TEXT" "#d00000" |