Skip to content

Commit e372996

Browse files
mergify[bot]mergify[bot]
authored
ci: add nightly workflow to update dependency lockfiles (#509)
## Summary - Adds a scheduled GitHub Actions workflow that regenerates pinned dependency lockfiles daily and opens a PR with the changes - Reuses the same branch for all PRs - force-pushes to this branch to prevent unnecessary additional commits & duplicate PRs - Closes stale lockfile PRs when lockfiles are already up to date with `main` - Notifies Slack on failure ## Test plan - [ ] Trigger the workflow manually via `workflow_dispatch` and verify it runs successfully - [ ] Verify PR is created with the expected lockfile changes - [ ] Verify stale PR closure when lockfiles are already up to date 🤖 Generated with [Claude Code](https://claude.com/claude-code) ## Summary by CodeRabbit ## Summary by CodeRabbit - **Chores** - Added an automated nightly and manual process to regenerate pinned dependency lockfiles. - Automatically opens or updates a pull request when lockfiles change. - Automatically closes and cleans up the automation pull request when lockfiles remain unchanged. - Notifies on workflow failures with a direct link to the workflow run to help with quick troubleshooting. Approved-by: nathan-weinberg Approved-by: skamenan7
2 parents b88b33a + f732efd commit e372996

1 file changed

Lines changed: 124 additions & 0 deletions

File tree

‎.github/workflows/update-lockfiles.yml‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
name: Update dependency lockfiles
2+
3+
on:
4+
schedule:
5+
- cron: '0 4 * * *'
6+
workflow_dispatch:
7+
8+
permissions: {}
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: true
13+
14+
jobs:
15+
update-lockfiles:
16+
runs-on: ubuntu-latest
17+
env:
18+
BRANCH: automated/update-lockfiles-${{ github.ref_name }}
19+
WORKFLOW_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
20+
steps:
21+
- name: Checkout repository
22+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
23+
with:
24+
token: ${{ secrets.RELEASE_TOKEN }}
25+
persist-credentials: false
26+
27+
- name: Install uv
28+
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
29+
with:
30+
python-version: 3.12
31+
enable-cache: false
32+
33+
- name: Regenerate lockfiles
34+
run: uv run build/gen_lockfile.py
35+
36+
- name: Check for changes
37+
id: changes
38+
run: |
39+
if git diff --quiet distribution/requirements-lock.txt distribution/requirements-lock-konflux.txt; then
40+
echo "changed=false" >> "$GITHUB_OUTPUT"
41+
echo "No lockfile changes detected"
42+
else
43+
echo "changed=true" >> "$GITHUB_OUTPUT"
44+
echo "Lockfile changes detected"
45+
fi
46+
47+
- name: Close stale PR if no changes
48+
if: steps.changes.outputs.changed == 'false'
49+
env:
50+
GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
51+
run: |
52+
PR_URL=$(gh pr list --head "$BRANCH" --state open --json url --jq '.[0].url' 2>/dev/null || echo "")
53+
if [ -n "$PR_URL" ]; then
54+
gh pr close "$BRANCH" --comment "Lockfiles are now up to date with \`main\`. Closing this PR."
55+
git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
56+
git push origin --delete "$BRANCH" 2>/dev/null || true
57+
echo "Closed stale PR and deleted branch"
58+
fi
59+
60+
- name: Configure git user
61+
if: steps.changes.outputs.changed == 'true'
62+
run: |
63+
git config user.name "github-actions[bot]"
64+
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
65+
66+
- name: Create branch and push
67+
if: steps.changes.outputs.changed == 'true'
68+
env:
69+
RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
70+
run: |
71+
git checkout -B "$BRANCH"
72+
git add distribution/requirements-lock.txt distribution/requirements-lock-konflux.txt
73+
git diff --cached --quiet && { echo "No changes to commit"; exit 0; }
74+
git commit -m "chore: update dependency lockfiles"
75+
git remote set-url origin "https://x-access-token:${RELEASE_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
76+
git push --force origin "$BRANCH"
77+
78+
- name: Create or update pull request
79+
if: steps.changes.outputs.changed == 'true'
80+
env:
81+
GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
82+
run: |
83+
PR_URL=$(gh pr list --head "$BRANCH" --state open --json url --jq '.[0].url' 2>/dev/null || echo "")
84+
85+
BODY=$(cat <<EOF
86+
## Automated lockfile update
87+
88+
> [!WARNING]
89+
> This PR is auto-generated. Do not request changes from the author - push
90+
> changes directly if necessary.
91+
92+
This PR regenerates the pinned dependency lockfiles to pick up upstream package changes.
93+
94+
### Updated files
95+
- \`distribution/requirements-lock.txt\`
96+
- \`distribution/requirements-lock-konflux.txt\`
97+
98+
> This PR was auto-generated by the [update-lockfiles workflow](${WORKFLOW_URL}).
99+
> Review the dependency changes and merge when ready.
100+
EOF
101+
)
102+
103+
if [ -n "$PR_URL" ]; then
104+
gh pr edit "$BRANCH" --body "$BODY"
105+
echo "Updated existing PR: $PR_URL"
106+
else
107+
gh pr create \
108+
--title "chore: update dependency lockfiles" \
109+
--body "$BODY" \
110+
--head "$BRANCH" \
111+
--base "${{ github.ref_name }}"
112+
fi
113+
114+
- name: Notify Slack on failure
115+
if: failure()
116+
env:
117+
SLACK_WEBHOOK_URL: ${{ secrets.WH_SLACK_TEAM_LLS_CORE }}
118+
run: |
119+
TIMESTAMP=$(date -u +%Y-%m-%dT%H:%M:%SZ)
120+
TEXT=$(printf '%s\n%s\n%s' \
121+
":failed: *Lockfile generation failed* - [${TIMESTAMP}]" \
122+
"Nightly lockfile update could not complete" \
123+
"<${WORKFLOW_URL}|View workflow run>")
124+
bash .github/actions/notify-slack/notify.sh "$TEXT" "#d00000"

0 commit comments

Comments
 (0)