update-dependencies 0.1.0__py3-none-any.whl

update_dependencies/__init__.py

@@ -0,0 +1,5 @@
+"""Dependency updates for repositories, locally and in GitHub Actions."""
+
+from importlib.metadata import version
+
+__version__ = version("update-dependencies")

update_dependencies/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+raise SystemExit(main())

update_dependencies/action.py

@@ -0,0 +1,97 @@
+"""Translate composite Action inputs to CLI arguments without shell evaluation."""
+
+import os
+from pathlib import Path
+
+from .cli import effective_config, main, parser
+
+# Each supported CLI setting is represented explicitly; no raw shell arguments.
+BOOLEAN_INPUTS = (
+    "dry-run",
+    "check",
+    "allow-major",
+    "python-inline-scripts",
+    "python-add-minimums",
+    "sync",
+    "python-update-build-backend",
+    "docker-pin-latest",
+    "no-config",
+)
+VALUE_INPUTS = (
+    "directory",
+    "config",
+    "ecosystems",
+    "min-age",
+    "stale-days",
+    "timeout",
+    "retries",
+    "progress",
+    "format",
+    "output",
+)
+LIST_INPUTS = ("include", "exclude")
+
+
+def arguments(environment: dict[str, str]) -> list[str]:
+    result = []
+    for name in BOOLEAN_INPUTS:
+        value = environment.get("UD_" + name.upper().replace("-", "_"), "").strip().lower()
+        if not value:
+            continue
+        if value not in {"true", "false"}:
+            raise ValueError(f"Action input {name} must be true or false")
+        if name == "no-config":
+            if value == "true":
+                result.append("--no-config")
+        else:
+            result.append(f"--{name}" if value == "true" else f"--no-{name}")
+    for name in VALUE_INPUTS:
+        value = environment.get("UD_" + name.upper().replace("-", "_"), "")
+        if value:
+            result.extend((f"--{name}", value))
+    for name in LIST_INPUTS:
+        for value in environment.get("UD_" + name.upper(), "").splitlines():
+            if value.strip():
+                result.extend((f"--{name}", value.strip()))
+    if "--output" not in result:
+        result.extend(
+            (
+                "--output",
+                str(Path(environment.get("RUNNER_TEMP", ".")) / "update-dependencies-report.json"),
+            )
+        )
+    return result
+
+
+def run() -> int:
+    try:
+        args = arguments(dict(os.environ))
+    except ValueError as error:
+        import sys
+
+        print(error, file=sys.stderr)
+        return 2
+    import sys
+
+    if sys.argv[1:] == ["--prepare"]:
+        try:
+            root, config = effective_config(parser().parse_args(args))
+            from .context import RunContext, use_context
+            from .discovery import inventory, matches
+            from .engine import skip_reason
+
+            files = [p for p in inventory(root) if matches(p, config.include, config.exclude)]
+            with use_context(RunContext(root, config, files=files)):
+                needs_docker = "docker" in config.ecosystems and skip_reason("docker") is None
+            output = Path(os.environ["GITHUB_OUTPUT"])
+            with output.open("a", encoding="utf-8") as stream:
+                stream.write(f"docker={'true' if needs_docker else 'false'}\n")
+            return 0
+        except (OSError, ValueError, TypeError) as error:
+            print(error, file=sys.stderr)
+            return 2
+    return main(args)
+
+
+if __name__ == "__main__":
+    raise SystemExit(run())

update_dependencies/cli.py

@@ -0,0 +1,247 @@
+"""Command line interface; explicit CLI values override repository configuration."""
+
+import argparse
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+from . import __version__
+from .config import ECOSYSTEMS, Config, load_config
+from .processes import redact
+from .progress import Progress
+from .reporting import github_report
+from .runner import run
+
+
+def parser() -> argparse.ArgumentParser:
+    result = argparse.ArgumentParser(
+        description="Update Python dependencies, GitHub Actions, Docker digests, and pre-commit hooks."
+    )
+    result.add_argument("--version", action="version", version=f"%(prog)s {__version__}")
+    result.add_argument(
+        "--directory",
+        type=Path,
+        default=Path.cwd(),
+        help="Target repository (default: current directory)",
+    )
+    group = result.add_mutually_exclusive_group()
+    group.add_argument("--config", type=Path)
+    group.add_argument("--no-config", action="store_true")
+    group = result.add_mutually_exclusive_group()
+    group.add_argument(
+        "--ecosystems",
+        type=lambda s: tuple(s.split(",")),
+        help="Comma-separated ecosystem names",
+    )
+    group.add_argument(
+        "--only",
+        choices=ECOSYSTEMS,
+        help="Compatibility alias for selecting one ecosystem",
+    )
+    booleans = {
+        "dry-run": "Preview without changing target files",
+        "check": "Preview; exit 1 when updates are available",
+        "allow-major": "Allow major updates (default: enabled)",
+        "python-inline-scripts": "Update PEP 723 script metadata",
+        "python-add-minimums": "Add floors to bare Python requirements",
+        "sync": "Install target environment after applying updates",
+        "python-update-build-backend": "Raise the uv_build floor independently",
+        "docker-pin-latest": "Pin latest and untagged Docker images",
+    }
+    for name, help_text in booleans.items():
+        result.add_argument(
+            f"--{name}",
+            action=argparse.BooleanOptionalAction,
+            default=None,
+            help=help_text,
+        )
+    result.add_argument(
+        "--no-major-version-updates",
+        dest="allow_major",
+        action="store_false",
+        default=None,
+        help="Alias for --no-allow-major",
+    )
+    result.add_argument(
+        "--enable-docker-latest-to-sha-updates",
+        dest="docker_pin_latest",
+        action="store_true",
+        default=None,
+        help="Alias for --docker-pin-latest",
+    )
+    result.add_argument(
+        "--add-python-latest-version",
+        dest="python_add_minimums",
+        action="store_true",
+        default=None,
+        help="Alias for --python-add-minimums",
+    )
+    result.add_argument(
+        "--no-update-python-inline-script-metadata",
+        dest="python_inline_scripts",
+        action="store_false",
+        default=None,
+        help="Alias for --no-python-inline-scripts",
+    )
+    result.add_argument(
+        "--update-docker-tags",
+        action="store_true",
+        help="Deprecated compatibility option (has no effect)",
+    )
+    result.add_argument("--min-age", dest="min_age_hours", type=int, default=None, metavar="HOURS")
+    result.add_argument("--stale-days", type=int, default=None)
+    result.add_argument("--timeout", type=int, default=None, help="Per-command timeout in seconds")
+    result.add_argument(
+        "--retries",
+        type=int,
+        default=None,
+        help="Retries for transient read-only lookups",
+    )
+    result.add_argument(
+        "--include",
+        action="append",
+        default=None,
+        help="File glob; repeat to add patterns",
+    )
+    result.add_argument(
+        "--exclude",
+        action="append",
+        default=None,
+        help="File glob; repeat to add patterns",
+    )
+    result.add_argument(
+        "--progress",
+        choices=("auto", "plain", "off"),
+        default=None,
+        help="Progress on stderr: auto, plain, or off",
+    )
+    result.add_argument("--format", choices=("text", "json"), default="text")
+    result.add_argument("--output", type=Path, help="Write the JSON report to this path")
+    result.add_argument(
+        "--print-config",
+        action="store_true",
+        help="Print effective configuration as JSON and exit",
+    )
+    result.add_argument(
+        "--tui",
+        action="store_true",
+        help="Configure interactively (requires the tui extra and a terminal)",
+    )
+    return result
+
+
+def interactive(config: Config, root: Path) -> Config:
+    from .context import RunContext, use_context
+
+    try:
+        import questionary  # noqa: F401
+
+        from .tui import prompt_tui
+    except ImportError as error:
+        raise ValueError("Install update-dependencies[tui] to use --tui") from error
+    values = argparse.Namespace(
+        only=None,
+        ecosystems=config.ecosystems,
+        dry_run=config.dry_run,
+        allow_major=config.allow_major,
+        min_age=config.min_age_hours,
+        add_python_latest_version=config.python_add_minimums,
+        update_python_inline_script_metadata=config.python_inline_scripts,
+        enable_docker_latest_to_sha_updates=config.docker_pin_latest,
+    )
+    with use_context(RunContext(root, config)):
+        values = prompt_tui(values)
+    return config.overlay(
+        {
+            "ecosystems": tuple(values.ecosystems),
+            "dry_run": values.dry_run,
+            "allow_major": values.allow_major,
+            "min_age_hours": values.min_age,
+            "python_add_minimums": values.add_python_latest_version,
+            "python_inline_scripts": values.update_python_inline_script_metadata,
+            "docker_pin_latest": values.enable_docker_latest_to_sha_updates,
+        }
+    )
+
+
+def effective_config(args) -> tuple[Path, Config]:
+    root = args.directory.expanduser().resolve(strict=True)
+    if not root.is_dir():
+        raise ValueError("--directory must refer to a directory")
+    config = load_config(root, args.config, args.no_config)
+    overrides = {key: getattr(args, key) for key in Config.__dataclass_fields__ if hasattr(args, key)}
+    for key in ("include", "exclude"):
+        if overrides.get(key) is not None:
+            overrides[key] = tuple(overrides[key])
+    if args.only:
+        overrides["ecosystems"] = (args.only,)
+    overrides["python_sync"] = args.sync
+    config = config.overlay(overrides)
+    return root, config
+
+
+def main(argv: list[str] | None = None) -> int:
+    arguments = parser()
+    args = arguments.parse_args(argv)
+    try:
+        root, config = effective_config(args)
+        if args.update_docker_tags:
+            print(
+                "warning: --update-docker-tags is deprecated and has no effect",
+                file=sys.stderr,
+            )
+        if args.tui:
+            config = interactive(config, root)
+        if args.print_config:
+            print(json.dumps(config.to_dict(), indent=2))
+            return 0
+        output = args.output.expanduser().absolute() if args.output else None
+        if output and output.exists():
+            if output.is_symlink():
+                raise ValueError("--output cannot overwrite a symlink")
+            try:
+                previous = json.loads(output.read_text(encoding="utf-8"))
+            except (OSError, ValueError) as error:
+                raise ValueError("--output refuses to overwrite an existing non-report file") from error
+            if (
+                not isinstance(previous, dict)
+                or "changed_files" not in previous
+                or previous.get("schema_version") != 1
+            ):
+                raise ValueError("--output refuses to overwrite an existing non-report file")
+        output = output.resolve() if output else None
+        with Progress(config.progress):
+            report = run(root, config, explicit=bool(args.only or args.ecosystems))
+        if output:
+            output.parent.mkdir(parents=True, exist_ok=True)
+            output.write_text(report.json(), encoding="utf-8")
+        github_report(report, output)
+        if args.format == "json":
+            print(report.json(), end="")
+        else:
+            mode = "Would update" if report.dry_run else "Updated"
+            print(f"{mode} {len(report.changed_files)} file(s).")
+            for path in report.changed_files:
+                print(f"  {path}")
+            for change in report.changes:
+                note = f" ({change['note']})" if change.get("note") else ""
+                print(f"  {change['ecosystem']}: {change['name']} {change['old']} -> {change['new']}{note}")
+            for item in report.skipped:
+                print(f"Skipped {item.get('ecosystem', item.get('file', ''))}: {item['reason']}")
+        return 1 if config.check and report.changed_files else 0
+    except (
+        OSError,
+        ValueError,
+        TypeError,
+        RuntimeError,
+        subprocess.SubprocessError,
+    ) as error:
+        if args.format == "json":
+            print(json.dumps({"schema_version": 1, "error": redact(str(error))}))
+        else:
+            print(f"error: {redact(str(error))}", file=sys.stderr)
+        return 2
+    except KeyboardInterrupt:
+        print("Cancelled.", file=sys.stderr)
+        return 130

update_dependencies/config.py

@@ -0,0 +1,106 @@
+"""Validated configuration shared by the CLI and GitHub Action."""
+
+import tomllib
+from dataclasses import asdict, dataclass, fields, replace
+from pathlib import Path
+
+ECOSYSTEMS = ("python", "actions", "docker", "hooks")
+
+
+@dataclass(frozen=True)
+class Config:
+    schema_version: int = 1
+    ecosystems: tuple[str, ...] = ECOSYSTEMS
+    include: tuple[str, ...] = ()
+    exclude: tuple[str, ...] = ()
+    allow_major: bool = True
+    min_age_hours: int = 48
+    stale_days: int = 180
+    dry_run: bool = False
+    check: bool = False
+    timeout: int = 120
+    retries: int = 2
+    progress: str = "auto"
+    python_inline_scripts: bool = True
+    python_add_minimums: bool = False
+    python_sync: bool = False
+    python_update_build_backend: bool = False
+    docker_pin_latest: bool = False
+
+    def validate(self) -> Config:
+        defaults = Config()
+        for item in fields(self):
+            value = getattr(self, item.name)
+            expected = type(getattr(defaults, item.name))
+            if type(value) is not expected:
+                raise ValueError(f"{item.name.replace('_', '-')} must be {expected.__name__}")
+            if expected is tuple and any(not isinstance(v, str) for v in value):
+                raise ValueError(f"{item.name} must contain strings")
+        if self.progress not in {"auto", "plain", "off"}:
+            raise ValueError("progress must be auto, plain, or off")
+        if self.schema_version != 1:
+            raise ValueError("Only schema-version = 1 is supported")
+        if not self.ecosystems or set(self.ecosystems) - set(ECOSYSTEMS):
+            raise ValueError(f"ecosystems must be a nonempty selection from {ECOSYSTEMS}")
+        if min(self.min_age_hours, self.stale_days, self.retries) < 0 or self.timeout < 1:
+            raise ValueError("Ages and retries must be >= 0; timeout must be >= 1")
+        return self
+
+    def overlay(self, values: dict) -> Config:
+        return replace(self, **{k: v for k, v in values.items() if v is not None}).validate()
+
+    def to_dict(self) -> dict:
+        return asdict(self)
+
+
+SECTIONS = {
+    "python": {
+        "inline-scripts": "python_inline_scripts",
+        "add-missing-minimums": "python_add_minimums",
+        "sync": "python_sync",
+        "update-build-backend": "python_update_build_backend",
+    },
+    "docker": {"pin-latest": "docker_pin_latest"},
+}
+
+
+def load_config(directory: Path, explicit: Path | None = None, disabled: bool = False) -> Config:
+    if disabled:
+        return Config()
+    path = explicit
+    if path is not None:
+        path = path if path.is_absolute() else directory / path
+    elif (directory / "update-dependencies.toml").is_file():
+        path = directory / "update-dependencies.toml"
+    elif (directory / "pyproject.toml").is_file():
+        path = directory / "pyproject.toml"
+    else:
+        return Config()
+    with path.open("rb") as stream:
+        data = tomllib.load(stream)
+    if path.name == "pyproject.toml":
+        data = data.get("tool", {}).get("update-dependencies", {})
+    if not isinstance(data, dict):
+        raise TypeError("Expected a configuration TOML table")
+    values = {}
+    top_level = {
+        f.name.replace("_", "-"): f.name
+        for f in fields(Config)
+        if not f.name.startswith(("python_", "docker_"))
+    }
+    for key, value in data.items():
+        if key in SECTIONS:
+            if not isinstance(value, dict):
+                raise ValueError(f"{key} must be a table")
+            for option, setting in value.items():
+                if option not in SECTIONS[key]:
+                    raise ValueError(f"Unknown configuration option: {key}.{option}")
+                values[SECTIONS[key][option]] = setting
+        elif key in top_level:
+            name = top_level[key]
+            if name in {"ecosystems", "include", "exclude"} and isinstance(value, list):
+                value = tuple(value)
+            values[name] = value
+        else:
+            raise ValueError(f"Unknown configuration option: {key}")
+    return Config().overlay(values)

update_dependencies/context.py

@@ -0,0 +1,50 @@
+"""State isolated to one invocation, including discovery and registry caches."""
+
+from contextlib import contextmanager
+from contextvars import ContextVar
+from dataclasses import dataclass, field
+from datetime import UTC, datetime, timedelta
+from pathlib import Path
+
+from .config import Config
+
+
+@dataclass
+class RunContext:
+    root: Path
+    config: Config
+    files: list[Path] | None = None
+    pyproject: Path = field(init=False)
+    uv_lock: Path = field(init=False)
+    pre_commit: Path = field(init=False)
+    action_files: list[Path] | None = None
+    dockerfiles: list[Path] | None = None
+    inline_scripts: list[Path] | None = None
+    opt_out_skips: list = field(default_factory=list)
+    docker_latest_skips: list = field(default_factory=list)
+    github_meta: dict = field(default_factory=dict)
+    policy_skips: list[dict] = field(default_factory=list)
+    uv_age_args: list[str] = field(init=False)
+
+    def __post_init__(self):
+        self.pyproject = self.root / "pyproject.toml"
+        self.uv_lock = self.root / "uv.lock"
+        self.pre_commit = self.root / ".pre-commit-config.yaml"
+        cutoff = datetime.now(UTC) - timedelta(hours=self.config.min_age_hours)
+        self.uv_age_args = ["--exclude-newer", cutoff.isoformat()] if self.config.min_age_hours else []
+
+
+_current: ContextVar[RunContext] = ContextVar("update_dependencies_context")
+
+
+def context() -> RunContext:
+    return _current.get()
+
+
+@contextmanager
+def use_context(value: RunContext):
+    token = _current.set(value)
+    try:
+        yield value
+    finally:
+        _current.reset(token)

update_dependencies/discovery.py

@@ -0,0 +1,72 @@
+"""Repository inventory with git-ignore semantics and explicit path filters."""
+
+import os
+import subprocess
+from fnmatch import fnmatchcase
+from pathlib import Path
+
+SKIP_DIRS = {
+    ".git",
+    ".venv",
+    "venv",
+    "node_modules",
+    ".tox",
+    "__pycache__",
+    ".pytest_cache",
+    ".ruff_cache",
+    "dist",
+    "build",
+}
+
+
+def walk(root: Path):
+    for directory, names, files in os.walk(root):
+        names[:] = [n for n in names if n not in SKIP_DIRS and not (Path(directory) / n).is_symlink()]
+        yield from ((Path(directory) / name).relative_to(root) for name in files)
+
+
+def inventory(root: Path) -> list[Path]:
+    try:
+        listed = subprocess.run(
+            [
+                "git",
+                "-c",
+                "core.fsmonitor=false",
+                "ls-files",
+                "-co",
+                "--exclude-standard",
+                "-z",
+            ],
+            cwd=root,
+            capture_output=True,
+            text=True,
+            timeout=30,
+            check=False,
+        )
+    except FileNotFoundError:
+        listed = None
+    candidates = (
+        (Path(p) for p in listed.stdout.split("\0") if p)
+        if listed is not None and listed.returncode == 0
+        else walk(root)
+    )
+    result = set()
+    for relative in candidates:
+        if relative.is_absolute() or ".." in relative.parts or set(relative.parts) & SKIP_DIRS:
+            continue
+        path = root / relative
+        if not path.is_file() or any(
+            (root / Path(*relative.parts[:i])).is_symlink() for i in range(1, len(relative.parts) + 1)
+        ):
+            continue
+        result.add(relative)
+    return sorted(result)
+
+
+def matches(path: Path, include: tuple[str, ...], exclude: tuple[str, ...]) -> bool:
+    name = path.as_posix()
+
+    def matched(pattern):
+        return fnmatchcase(name, pattern) or (pattern.startswith("**/") and fnmatchcase(name, pattern[3:]))
+
+    return (not include or any(matched(p) for p in include)) and not any(matched(p) for p in exclude)

update_dependencies/ecosystems/__init__.py

@@ -0,0 +1 @@
+"""Ecosystem-specific update operations."""