update-dependencies 0.1.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- update_dependencies-0.1.0/.python-version +1 -0
- update_dependencies-0.1.0/CHANGELOG.md +12 -0
- update_dependencies-0.1.0/LICENSE +21 -0
- update_dependencies-0.1.0/PKG-INFO +99 -0
- update_dependencies-0.1.0/README.md +77 -0
- update_dependencies-0.1.0/docs/configuration.md +148 -0
- update_dependencies-0.1.0/docs/github-action.md +99 -0
- update_dependencies-0.1.0/pyproject.toml +65 -0
- update_dependencies-0.1.0/pyproject.toml.orig +45 -0
- update_dependencies-0.1.0/src/update_dependencies/__init__.py +5 -0
- update_dependencies-0.1.0/src/update_dependencies/__main__.py +3 -0
- update_dependencies-0.1.0/src/update_dependencies/action.py +97 -0
- update_dependencies-0.1.0/src/update_dependencies/cli.py +247 -0
- update_dependencies-0.1.0/src/update_dependencies/config.py +106 -0
- update_dependencies-0.1.0/src/update_dependencies/context.py +50 -0
- update_dependencies-0.1.0/src/update_dependencies/discovery.py +72 -0
- update_dependencies-0.1.0/src/update_dependencies/ecosystems/__init__.py +1 -0
- update_dependencies-0.1.0/src/update_dependencies/ecosystems/actions.py +309 -0
- update_dependencies-0.1.0/src/update_dependencies/ecosystems/docker.py +125 -0
- update_dependencies-0.1.0/src/update_dependencies/ecosystems/hooks.py +93 -0
- update_dependencies-0.1.0/src/update_dependencies/ecosystems/python.py +139 -0
- update_dependencies-0.1.0/src/update_dependencies/engine.py +1152 -0
- update_dependencies-0.1.0/src/update_dependencies/processes.py +75 -0
- update_dependencies-0.1.0/src/update_dependencies/progress.py +68 -0
- update_dependencies-0.1.0/src/update_dependencies/reporting.py +47 -0
- update_dependencies-0.1.0/src/update_dependencies/runner.py +237 -0
- update_dependencies-0.1.0/src/update_dependencies/tui.py +180 -0
- update_dependencies-0.1.0/tests/Dockerfile +11 -0
- update_dependencies-0.1.0/tests/test_configuration.py +118 -0
- update_dependencies-0.1.0/tests/test_hooks_policy.py +51 -0
- update_dependencies-0.1.0/tests/test_no_auto_update.py +504 -0
- update_dependencies-0.1.0/tests/test_processes.py +42 -0
- update_dependencies-0.1.0/tests/test_progress.py +88 -0
- update_dependencies-0.1.0/tests/test_runner.py +231 -0
|
@@ -0,0 +1 @@
|
|
|
1
|
+
3.14
|
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
# Changelog
|
|
2
|
+
|
|
3
|
+
## 0.1.0
|
|
4
|
+
|
|
5
|
+
- Package the updater with uv_build and a Python 3.14 CLI.
|
|
6
|
+
- Share validated TOML configuration between the CLI and composite GitHub Action.
|
|
7
|
+
- Stage updates before applying; add check mode, JSON reports, and file filters.
|
|
8
|
+
- Separate ecosystem operations and isolate per-run state.
|
|
9
|
+
- Make environment synchronization and build-backend updating opt-in.
|
|
10
|
+
- Add CI, clean artifact installation checks, and PyPI Trusted Publishing.
|
|
11
|
+
- Report stage and per-file progress on stderr with elapsed times and configurable verbosity.
|
|
12
|
+
- Format Python code with a 110-character Ruff line length.
|
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 Jesse Goodier
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
|
@@ -0,0 +1,99 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: update-dependencies
|
|
3
|
+
Version: 0.1.0
|
|
4
|
+
Summary: Update Python dependencies, GitHub Actions, Docker digests, and pre-commit hooks.
|
|
5
|
+
Keywords: dependencies,github-actions,uv,automation
|
|
6
|
+
Author: Jesse Goodier
|
|
7
|
+
License-Expression: MIT
|
|
8
|
+
License-File: LICENSE
|
|
9
|
+
Classifier: Development Status :: 3 - Alpha
|
|
10
|
+
Classifier: Environment :: Console
|
|
11
|
+
Classifier: Programming Language :: Python :: 3.14
|
|
12
|
+
Classifier: Topic :: Software Development :: Build Tools
|
|
13
|
+
Requires-Dist: packaging>=26.3
|
|
14
|
+
Requires-Dist: rich>=15.0.0
|
|
15
|
+
Requires-Dist: pyyaml>=6.0.3
|
|
16
|
+
Requires-Dist: questionary>=2.1.1 ; extra == 'tui'
|
|
17
|
+
Requires-Python: >=3.14, <3.15
|
|
18
|
+
Project-URL: Homepage, https://github.com/jessegoodier/update-dependencies
|
|
19
|
+
Project-URL: Issues, https://github.com/jessegoodier/update-dependencies/issues
|
|
20
|
+
Provides-Extra: tui
|
|
21
|
+
Description-Content-Type: text/markdown
|
|
22
|
+
|
|
23
|
+
# update-dependencies
|
|
24
|
+
|
|
25
|
+
Update Python dependencies and PEP 723 scripts, pin GitHub Actions to commit SHAs,
|
|
26
|
+
refresh Docker image digests, and freeze pre-commit hook revisions.
|
|
27
|
+
|
|
28
|
+
Requires **Python 3.14** (`>=3.14,<3.15`). Development and GitHub Actions also use
|
|
29
|
+
3.14. Managed repositories may target other Python versions; resolution follows
|
|
30
|
+
their own metadata.
|
|
31
|
+
|
|
32
|
+
```sh
|
|
33
|
+
uv tool install update-dependencies
|
|
34
|
+
update-dependencies --directory /path/to/repository --dry-run
|
|
35
|
+
update-dependencies --ecosystems python,actions --no-allow-major
|
|
36
|
+
```
|
|
37
|
+
|
|
38
|
+
Before the first PyPI release, install from this checkout with `uv tool install .`.
|
|
39
|
+
For interactive prompts, install `uv tool install 'update-dependencies[tui]'` and
|
|
40
|
+
run `update-dependencies --tui`.
|
|
41
|
+
|
|
42
|
+
All ecosystems are selected by default. Major updates remain enabled for
|
|
43
|
+
compatibility; set `allow-major = false` for a conservative policy. `NO_AUTO_UPDATE`
|
|
44
|
+
in a same-line or immediately preceding comment preserves individual exclusions.
|
|
45
|
+
Docker `latest` tags are left alone unless explicitly enabled.
|
|
46
|
+
|
|
47
|
+
Progress on stderr shows the current ecosystem, files/lookups, and elapsed times.
|
|
48
|
+
Use `--progress plain` for logs or `--progress off` for quiet runs; JSON output
|
|
49
|
+
stays on stdout.
|
|
50
|
+
|
|
51
|
+
Updates are prepared in a temporary copy before applying changes. Dry runs and
|
|
52
|
+
checks leave target files untouched. Environment installation is opt-in (`--sync`).
|
|
53
|
+
Python updates currently support uv projects/lockfiles and PEP 723 scripts;
|
|
54
|
+
requirements.txt, Poetry, and Pipenv lockfiles are not supported.
|
|
55
|
+
|
|
56
|
+
## GitHub Action
|
|
57
|
+
|
|
58
|
+
```yaml
|
|
59
|
+
permissions:
|
|
60
|
+
contents: read
|
|
61
|
+
|
|
62
|
+
steps:
|
|
63
|
+
- uses: actions/checkout@v7
|
|
64
|
+
- uses: jessegoodier/update-dependencies@v0.1.0
|
|
65
|
+
with:
|
|
66
|
+
config: update-dependencies.toml
|
|
67
|
+
dry-run: 'true'
|
|
68
|
+
env:
|
|
69
|
+
GH_TOKEN: ${{ github.token }}
|
|
70
|
+
```
|
|
71
|
+
|
|
72
|
+
The release reference above becomes usable after the first release is pushed.
|
|
73
|
+
Pin actions to full commit SHAs in production. The Action supports Linux hosted
|
|
74
|
+
runners initially; it installs its own isolated Python tool environment and uses
|
|
75
|
+
the package from the Action revision. It does not commit or open pull requests.
|
|
76
|
+
See [Action usage](docs/github-action.md) and [configuration](docs/configuration.md).
|
|
77
|
+
|
|
78
|
+
## Development and releases
|
|
79
|
+
|
|
80
|
+
Ruff formats Python code with a line length of 110 characters.
|
|
81
|
+
|
|
82
|
+
```sh
|
|
83
|
+
uv sync --locked --all-extras
|
|
84
|
+
uv run pytest
|
|
85
|
+
uv run ruff check .
|
|
86
|
+
uv run ruff format --check .
|
|
87
|
+
uv build
|
|
88
|
+
```
|
|
89
|
+
|
|
90
|
+
`scripts/update_dependencies.py` is a compatibility launcher for an installed
|
|
91
|
+
checkout. Run it with `uv run python scripts/update_dependencies.py --help`.
|
|
92
|
+
The old root filename was moved to avoid shadowing the installed Python package.
|
|
93
|
+
|
|
94
|
+
Release by updating `project.version`, regenerating `uv.lock`, and pushing a
|
|
95
|
+
matching `vX.Y.Z` tag. The release workflow builds, checks, installs, and smoke-tests
|
|
96
|
+
both distribution formats before publishing through PyPI Trusted Publishing.
|
|
97
|
+
Configure the PyPI trusted publisher for this repository, `release.yml`, and the
|
|
98
|
+
`pypi` GitHub environment before publishing. No stored PyPI API token is needed.
|
|
99
|
+
PyPI project-name availability/ownership must be confirmed by the publisher.
|
|
@@ -0,0 +1,77 @@
|
|
|
1
|
+
# update-dependencies
|
|
2
|
+
|
|
3
|
+
Update Python dependencies and PEP 723 scripts, pin GitHub Actions to commit SHAs,
|
|
4
|
+
refresh Docker image digests, and freeze pre-commit hook revisions.
|
|
5
|
+
|
|
6
|
+
Requires **Python 3.14** (`>=3.14,<3.15`). Development and GitHub Actions also use
|
|
7
|
+
3.14. Managed repositories may target other Python versions; resolution follows
|
|
8
|
+
their own metadata.
|
|
9
|
+
|
|
10
|
+
```sh
|
|
11
|
+
uv tool install update-dependencies
|
|
12
|
+
update-dependencies --directory /path/to/repository --dry-run
|
|
13
|
+
update-dependencies --ecosystems python,actions --no-allow-major
|
|
14
|
+
```
|
|
15
|
+
|
|
16
|
+
Before the first PyPI release, install from this checkout with `uv tool install .`.
|
|
17
|
+
For interactive prompts, install `uv tool install 'update-dependencies[tui]'` and
|
|
18
|
+
run `update-dependencies --tui`.
|
|
19
|
+
|
|
20
|
+
All ecosystems are selected by default. Major updates remain enabled for
|
|
21
|
+
compatibility; set `allow-major = false` for a conservative policy. `NO_AUTO_UPDATE`
|
|
22
|
+
in a same-line or immediately preceding comment preserves individual exclusions.
|
|
23
|
+
Docker `latest` tags are left alone unless explicitly enabled.
|
|
24
|
+
|
|
25
|
+
Progress on stderr shows the current ecosystem, files/lookups, and elapsed times.
|
|
26
|
+
Use `--progress plain` for logs or `--progress off` for quiet runs; JSON output
|
|
27
|
+
stays on stdout.
|
|
28
|
+
|
|
29
|
+
Updates are prepared in a temporary copy before applying changes. Dry runs and
|
|
30
|
+
checks leave target files untouched. Environment installation is opt-in (`--sync`).
|
|
31
|
+
Python updates currently support uv projects/lockfiles and PEP 723 scripts;
|
|
32
|
+
requirements.txt, Poetry, and Pipenv lockfiles are not supported.
|
|
33
|
+
|
|
34
|
+
## GitHub Action
|
|
35
|
+
|
|
36
|
+
```yaml
|
|
37
|
+
permissions:
|
|
38
|
+
contents: read
|
|
39
|
+
|
|
40
|
+
steps:
|
|
41
|
+
- uses: actions/checkout@v7
|
|
42
|
+
- uses: jessegoodier/update-dependencies@v0.1.0
|
|
43
|
+
with:
|
|
44
|
+
config: update-dependencies.toml
|
|
45
|
+
dry-run: 'true'
|
|
46
|
+
env:
|
|
47
|
+
GH_TOKEN: ${{ github.token }}
|
|
48
|
+
```
|
|
49
|
+
|
|
50
|
+
The release reference above becomes usable after the first release is pushed.
|
|
51
|
+
Pin actions to full commit SHAs in production. The Action supports Linux hosted
|
|
52
|
+
runners initially; it installs its own isolated Python tool environment and uses
|
|
53
|
+
the package from the Action revision. It does not commit or open pull requests.
|
|
54
|
+
See [Action usage](docs/github-action.md) and [configuration](docs/configuration.md).
|
|
55
|
+
|
|
56
|
+
## Development and releases
|
|
57
|
+
|
|
58
|
+
Ruff formats Python code with a line length of 110 characters.
|
|
59
|
+
|
|
60
|
+
```sh
|
|
61
|
+
uv sync --locked --all-extras
|
|
62
|
+
uv run pytest
|
|
63
|
+
uv run ruff check .
|
|
64
|
+
uv run ruff format --check .
|
|
65
|
+
uv build
|
|
66
|
+
```
|
|
67
|
+
|
|
68
|
+
`scripts/update_dependencies.py` is a compatibility launcher for an installed
|
|
69
|
+
checkout. Run it with `uv run python scripts/update_dependencies.py --help`.
|
|
70
|
+
The old root filename was moved to avoid shadowing the installed Python package.
|
|
71
|
+
|
|
72
|
+
Release by updating `project.version`, regenerating `uv.lock`, and pushing a
|
|
73
|
+
matching `vX.Y.Z` tag. The release workflow builds, checks, installs, and smoke-tests
|
|
74
|
+
both distribution formats before publishing through PyPI Trusted Publishing.
|
|
75
|
+
Configure the PyPI trusted publisher for this repository, `release.yml`, and the
|
|
76
|
+
`pypi` GitHub environment before publishing. No stored PyPI API token is needed.
|
|
77
|
+
PyPI project-name availability/ownership must be confirmed by the publisher.
|
|
@@ -0,0 +1,148 @@
|
|
|
1
|
+
# Configuration
|
|
2
|
+
|
|
3
|
+
Precedence is built-in defaults, repository configuration, then explicit CLI or
|
|
4
|
+
Action inputs. Unset boolean Action inputs inherit config; `false` overrides it.
|
|
5
|
+
List overrides replace the configured list. Unknown keys and invalid values fail
|
|
6
|
+
before any updating begins.
|
|
7
|
+
|
|
8
|
+
Discovery checks `update-dependencies.toml` first, then
|
|
9
|
+
`[tool.update-dependencies]` in `pyproject.toml`. Exactly one file is loaded.
|
|
10
|
+
`--config PATH` selects a file explicitly, relative to `--directory`.
|
|
11
|
+
`--no-config` disables discovery. `--print-config` prints effective JSON without
|
|
12
|
+
network calls. `--directory` defaults to the caller's current working directory.
|
|
13
|
+
|
|
14
|
+
```toml
|
|
15
|
+
# update-dependencies.toml
|
|
16
|
+
schema-version = 1
|
|
17
|
+
ecosystems = ["python", "actions", "docker", "hooks"]
|
|
18
|
+
allow-major = false
|
|
19
|
+
min-age-hours = 48
|
|
20
|
+
stale-days = 180
|
|
21
|
+
dry-run = false
|
|
22
|
+
check = false
|
|
23
|
+
timeout = 120
|
|
24
|
+
retries = 2
|
|
25
|
+
progress = "auto"
|
|
26
|
+
include = []
|
|
27
|
+
exclude = ["vendor/**", "tests/fixtures/**"]
|
|
28
|
+
|
|
29
|
+
[python]
|
|
30
|
+
inline-scripts = true
|
|
31
|
+
add-missing-minimums = false
|
|
32
|
+
update-build-backend = false
|
|
33
|
+
sync = false
|
|
34
|
+
|
|
35
|
+
[docker]
|
|
36
|
+
pin-latest = false
|
|
37
|
+
```
|
|
38
|
+
|
|
39
|
+
For `pyproject.toml`, prefix all tables with `tool.update-dependencies`:
|
|
40
|
+
|
|
41
|
+
```toml
|
|
42
|
+
[tool.update-dependencies]
|
|
43
|
+
allow-major = false
|
|
44
|
+
|
|
45
|
+
[tool.update-dependencies.python]
|
|
46
|
+
inline-scripts = true
|
|
47
|
+
```
|
|
48
|
+
|
|
49
|
+
| Configuration key | CLI | Default |
|
|
50
|
+
| --- | --- | --- |
|
|
51
|
+
| `schema-version` | Config only | `1` |
|
|
52
|
+
| `ecosystems` | `--ecosystems python,actions` or `--only python` | All four |
|
|
53
|
+
| `allow-major` | `--allow-major` / `--no-allow-major` | `true` |
|
|
54
|
+
| `min-age-hours` | `--min-age HOURS` | `48` |
|
|
55
|
+
| `stale-days` | `--stale-days DAYS` | `180` |
|
|
56
|
+
| `dry-run` | `--dry-run` / `--no-dry-run` | `false` |
|
|
57
|
+
| `check` | `--check` / `--no-check` | `false` |
|
|
58
|
+
| `timeout` | `--timeout SECONDS` | `120` |
|
|
59
|
+
| `retries` | `--retries COUNT` | `2` |
|
|
60
|
+
| `progress` | `--progress auto\|plain\|off` | `auto` |
|
|
61
|
+
| `include` | Repeatable `--include GLOB` | All discovered files |
|
|
62
|
+
| `exclude` | Repeatable `--exclude GLOB` | Empty |
|
|
63
|
+
| `python.inline-scripts` | `--python-inline-scripts` / `--no-python-inline-scripts` | `true` |
|
|
64
|
+
| `python.add-missing-minimums` | `--python-add-minimums` / `--no-python-add-minimums` | `false` |
|
|
65
|
+
| `python.update-build-backend` | `--python-update-build-backend` / `--no-python-update-build-backend` | `false` |
|
|
66
|
+
| `python.sync` | `--sync` / `--no-sync` | `false` |
|
|
67
|
+
| `docker.pin-latest` | `--docker-pin-latest` / `--no-docker-pin-latest` | `false` |
|
|
68
|
+
|
|
69
|
+
Progress is written to stderr, including elapsed time, ecosystem start/completion,
|
|
70
|
+
current files or dependency lookups, retries, validation, and application. `auto`
|
|
71
|
+
adds a spinner in an interactive terminal and emits plain lines in CI or redirected
|
|
72
|
+
logs. `plain` always emits plain lines; `off` disables progress messages. Errors and
|
|
73
|
+
warnings still appear. Long commands remain bounded by the configured timeout;
|
|
74
|
+
progress does not stream subprocess stdout/stderr or change update behavior.
|
|
75
|
+
Use ecosystem completion timings to identify which updates take the most time.
|
|
76
|
+
|
|
77
|
+
`--format text|json` selects console output. `--output PATH` also writes a JSON
|
|
78
|
+
report. `--version` prints the installed package version. `--tui` enables the
|
|
79
|
+
optional interactive interface and seeds its choices from the effective config.
|
|
80
|
+
|
|
81
|
+
Legacy aliases remain: `--no-major-version-updates`,
|
|
82
|
+
`--enable-docker-latest-to-sha-updates`, `--add-python-latest-version`, and
|
|
83
|
+
`--no-update-python-inline-script-metadata`. `--update-docker-tags` is deprecated
|
|
84
|
+
and emits a warning; Docker digest updates have always been the default.
|
|
85
|
+
|
|
86
|
+
## Policy and scope
|
|
87
|
+
|
|
88
|
+
Python updates cover a root uv project and PEP 723 scripts anywhere under the
|
|
89
|
+
target directory. Requirements files, Poetry, and Pipenv are not supported.
|
|
90
|
+
GitHub updates cover `.github/**/*.yml`, `.github/**/*.yaml`, and all root/nested
|
|
91
|
+
`action.yml` and `action.yaml` files. Docker updates refresh digests for existing
|
|
92
|
+
tags, without choosing newer image tags. Hooks use `pre-commit autoupdate --freeze`.
|
|
93
|
+
|
|
94
|
+
`allow-major = false` holds Python direct dependency major lines using the current
|
|
95
|
+
lock (or a requirement's version floor when no lock exists). For `0.x` dependencies,
|
|
96
|
+
the minor line is held. Bare requirements without a lock cannot be safely held and
|
|
97
|
+
produce an error. Transitive dependencies remain subject to the resolver. Actions
|
|
98
|
+
hold major upgrades and can pin their current ref. Hooks obey the major policy
|
|
99
|
+
when both old and new revisions have version labels; revisions that cannot be
|
|
100
|
+
compared are held when major updates are disabled. Docker digests retain tags.
|
|
101
|
+
|
|
102
|
+
Cooldowns apply to GitHub Action releases, uv Python resolution, PEP 723 resolution,
|
|
103
|
+
and explicit uv_build updates. Docker digests and pre-commit revisions do not have
|
|
104
|
+
a universal release-time source, so `min-age` does not apply to those ecosystems.
|
|
105
|
+
Maintenance age is informational, not a judgment that a project is unmaintained.
|
|
106
|
+
|
|
107
|
+
The build-backend flag independently raises an existing `uv_build` floor within
|
|
108
|
+
its existing bounds. It does not change Docker uv image tags. Adding missing
|
|
109
|
+
Python minimums only affects bare dependency requirements.
|
|
110
|
+
|
|
111
|
+
Git inventory respects tracked files and untracked files not ignored by Git.
|
|
112
|
+
Outside Git, common environment/build directories are excluded. Symlinks are
|
|
113
|
+
skipped. Globs match repository-relative paths using shell-style matching;
|
|
114
|
+
`*` also matches `/`, and leading `**/` can match root files. Filters control
|
|
115
|
+
manifest discovery; paired lockfiles are updated together with their manifests.
|
|
116
|
+
The complete nonignored inventory is copied for resolution so local paths inside
|
|
117
|
+
the repository remain available. Hook updates initialize a fresh staging Git
|
|
118
|
+
repository; original Git history, tags, and worktree metadata are not copied. Paths outside the target directory and external
|
|
119
|
+
Git worktrees are not mirrored; choose the enclosing repository as `--directory`.
|
|
120
|
+
Ignored local dependencies must be made available as nonignored files first.
|
|
121
|
+
|
|
122
|
+
## Results and failures
|
|
123
|
+
|
|
124
|
+
Exit codes: `0` success (including no applicable files), `1` updates available in
|
|
125
|
+
check mode, `2` configuration/tool/update failure, `130` interruption.
|
|
126
|
+
Explicit `--only` or `--ecosystems` selections fail if an ecosystem has no applicable
|
|
127
|
+
files; automatic defaults report those ecosystems as skipped.
|
|
128
|
+
|
|
129
|
+
JSON reports have `schema_version`, `changed`, `change_count`, `changed_files`,
|
|
130
|
+
`changes`, `skipped`, and `dry_run`. `change_count` counts changed **files**; change
|
|
131
|
+
rows may also contain informational or held updates. Optional maintenance lookups
|
|
132
|
+
can be unavailable without blocking updates. Required resolution errors abort the
|
|
133
|
+
run; no staged changes are applied. Process diagnostics redact credential-like
|
|
134
|
+
environment values and URL passwords.
|
|
135
|
+
|
|
136
|
+
Updates resolve in a temporary copy, validate modified TOML/YAML, and check for
|
|
137
|
+
concurrent target edits before applying. Apply failures attempt to restore written
|
|
138
|
+
files. This is not a crash-safe filesystem transaction: forced termination or a
|
|
139
|
+
machine crash during final writes can leave a partial apply. Existing dirty files
|
|
140
|
+
are treated as the starting point and preserved unless the updater intentionally
|
|
141
|
+
changes them. Text updates retain original CRLF conventions.
|
|
142
|
+
|
|
143
|
+
`--sync` installs the real target environment after successful application. It can
|
|
144
|
+
execute target build machinery; if sync fails, manifest updates remain applied.
|
|
145
|
+
Neither dry-run nor check performs sync. Dependency resolution itself can invoke
|
|
146
|
+
build backends to obtain package metadata; use trusted repository inputs. Registry and subprocess timeouts apply
|
|
147
|
+
per request/command, not to the entire run. Retries apply only to read-only,
|
|
148
|
+
transient lookups; mutating commands are never retried.
|
|
@@ -0,0 +1,99 @@
|
|
|
1
|
+
# GitHub Action
|
|
2
|
+
|
|
3
|
+
The root `action.yml` is a composite action for Linux runners. It installs uv
|
|
4
|
+
0.13.6 and Python 3.14, installs this Action revision's package and locked runtime
|
|
5
|
+
dependencies into a unique isolated environment, reads configuration, optionally
|
|
6
|
+
sets up Docker Buildx, then runs the same CLI shipped on PyPI.
|
|
7
|
+
|
|
8
|
+
GitHub-hosted Ubuntu includes GitHub CLI and Docker. Self-hosted Linux runners
|
|
9
|
+
must supply Git, GitHub CLI for Actions updates, and Docker for image updates.
|
|
10
|
+
Pre-commit is run through uv's separate tool environment; it does not need to be
|
|
11
|
+
installed in the target project. Registry access is needed to provision tools and
|
|
12
|
+
resolve updates. Docker authentication uses the caller's existing Docker config;
|
|
13
|
+
public ECR lookups use anonymous/public token access.
|
|
14
|
+
|
|
15
|
+
```yaml
|
|
16
|
+
name: Dependency updates
|
|
17
|
+
on:
|
|
18
|
+
workflow_dispatch:
|
|
19
|
+
schedule:
|
|
20
|
+
- cron: '23 9 * * 1'
|
|
21
|
+
permissions:
|
|
22
|
+
contents: read
|
|
23
|
+
concurrency:
|
|
24
|
+
group: dependency-updates
|
|
25
|
+
cancel-in-progress: false
|
|
26
|
+
jobs:
|
|
27
|
+
update:
|
|
28
|
+
runs-on: ubuntu-latest
|
|
29
|
+
steps:
|
|
30
|
+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
31
|
+
- uses: jessegoodier/update-dependencies@v0.1.0
|
|
32
|
+
id: update
|
|
33
|
+
with:
|
|
34
|
+
config: update-dependencies.toml
|
|
35
|
+
allow-major: 'false'
|
|
36
|
+
dry-run: 'true'
|
|
37
|
+
progress: plain
|
|
38
|
+
env:
|
|
39
|
+
GH_TOKEN: ${{ github.token }}
|
|
40
|
+
```
|
|
41
|
+
|
|
42
|
+
The first versioned reference becomes available after release. Prefer a full
|
|
43
|
+
release commit SHA for production. The repository's own scheduled workflow uses
|
|
44
|
+
its checked-out action and uploads a preview report. GitHub Actions publishing
|
|
45
|
+
and PyPI publishing are separate: this action can run directly from a repository
|
|
46
|
+
commit even before the first PyPI release.
|
|
47
|
+
|
|
48
|
+
Inputs mirror [configuration CLI options](configuration.md). Every boolean accepts
|
|
49
|
+
`'true'` or `'false'`; empty means inherit. `ecosystems` is comma-separated;
|
|
50
|
+
`include` and `exclude` are newline-separated globs. Runtime-only inputs are
|
|
51
|
+
`directory`, `config`, `no-config`, `format`, and `output`. Interactive prompting,
|
|
52
|
+
printing config, and legacy no-op aliases are intentionally absent from the Action.
|
|
53
|
+
Secrets belong in environment variables (`GH_TOKEN`, registry credentials via a
|
|
54
|
+
login step), not committed TOML or argument strings. The Action passes input
|
|
55
|
+
values through environment variables and constructs Python argument lists.
|
|
56
|
+
|
|
57
|
+
Outputs:
|
|
58
|
+
|
|
59
|
+
| Output | Meaning |
|
|
60
|
+
| --- | --- |
|
|
61
|
+
| `changed` | `true` if files changed or would change in a preview |
|
|
62
|
+
| `change-count` | Changed file count |
|
|
63
|
+
| `changed-files` | JSON array of repository-relative paths |
|
|
64
|
+
| `report-path` | Absolute JSON report path |
|
|
65
|
+
|
|
66
|
+
A default report is written to `$RUNNER_TEMP/update-dependencies-report.json`;
|
|
67
|
+
set `output` for distinct reports when running multiple instances in one job.
|
|
68
|
+
A step summary is written automatically. The `progress` input accepts `auto`,
|
|
69
|
+
`plain`, or `off`, and defaults to inheriting repository configuration. CI progress
|
|
70
|
+
is written as plain stderr lines with elapsed times; JSON stdout remains separate. Check mode returns a failing step when
|
|
71
|
+
updates exist; use `continue-on-error` when the caller intends to inspect that
|
|
72
|
+
outcome and continue.
|
|
73
|
+
|
|
74
|
+
The action edits the checkout when dry-run/check are disabled. It does not commit,
|
|
75
|
+
push, open PRs, or merge changes. A caller can use the report and changed files in
|
|
76
|
+
its own PR workflow, granting write permissions only there. A PR bot token may be
|
|
77
|
+
needed if the resulting PR must trigger other workflows; workflow-file changes
|
|
78
|
+
may require additional token permissions. Run write-enabled updating only on
|
|
79
|
+
trusted branches and never execute untrusted PR code with privileged credentials.
|
|
80
|
+
|
|
81
|
+
## Release setup
|
|
82
|
+
|
|
83
|
+
Create the `pypi` GitHub environment, and configure PyPI Trusted Publishing with:
|
|
84
|
+
|
|
85
|
+
- PyPI project: `update-dependencies`
|
|
86
|
+
- GitHub owner: `jessegoodier`
|
|
87
|
+
- Repository: `update-dependencies`
|
|
88
|
+
- Workflow: `release.yml`
|
|
89
|
+
- Environment: `pypi`
|
|
90
|
+
|
|
91
|
+
The tagged package version must equal the tag without `v`. Build/test and artifact
|
|
92
|
+
installation occur in a read-only job. Only the separate publish job requests
|
|
93
|
+
`id-token: write`; it downloads the validated artifacts and uses the SHA-pinned
|
|
94
|
+
PyPA publishing action. No permanent API token is configured.
|
|
95
|
+
|
|
96
|
+
Current official references verified during the 2026 migration:
|
|
97
|
+
[uv build backend](https://docs.astral.sh/uv/concepts/build-backend/),
|
|
98
|
+
[GitHub Action metadata](https://docs.github.com/en/actions/reference/workflows-and-actions/metadata-syntax),
|
|
99
|
+
[PyPI Trusted Publishing](https://docs.pypi.org/trusted-publishers/using-a-publisher/).
|
|
@@ -0,0 +1,65 @@
|
|
|
1
|
+
[build-system]
|
|
2
|
+
requires = ["uv_build>=0.13.6,<0.14"]
|
|
3
|
+
build-backend = "uv_build"
|
|
4
|
+
|
|
5
|
+
[project]
|
|
6
|
+
name = "update-dependencies"
|
|
7
|
+
version = "0.1.0"
|
|
8
|
+
description = "Update Python dependencies, GitHub Actions, Docker digests, and pre-commit hooks."
|
|
9
|
+
readme = "README.md"
|
|
10
|
+
requires-python = ">=3.14,<3.15"
|
|
11
|
+
license = "MIT"
|
|
12
|
+
license-files = ["LICENSE"]
|
|
13
|
+
keywords = [
|
|
14
|
+
"dependencies",
|
|
15
|
+
"github-actions",
|
|
16
|
+
"uv",
|
|
17
|
+
"automation",
|
|
18
|
+
]
|
|
19
|
+
classifiers = [
|
|
20
|
+
"Development Status :: 3 - Alpha",
|
|
21
|
+
"Environment :: Console",
|
|
22
|
+
"Programming Language :: Python :: 3.14",
|
|
23
|
+
"Topic :: Software Development :: Build Tools",
|
|
24
|
+
]
|
|
25
|
+
dependencies = [
|
|
26
|
+
"packaging>=26.3",
|
|
27
|
+
"rich>=15.0.0",
|
|
28
|
+
"pyyaml>=6.0.3",
|
|
29
|
+
]
|
|
30
|
+
|
|
31
|
+
[[project.authors]]
|
|
32
|
+
name = "Jesse Goodier"
|
|
33
|
+
|
|
34
|
+
[project.optional-dependencies]
|
|
35
|
+
tui = ["questionary>=2.1.1"]
|
|
36
|
+
|
|
37
|
+
[project.scripts]
|
|
38
|
+
update-dependencies = "update_dependencies.cli:main"
|
|
39
|
+
|
|
40
|
+
[project.urls]
|
|
41
|
+
Homepage = "https://github.com/jessegoodier/update-dependencies"
|
|
42
|
+
Issues = "https://github.com/jessegoodier/update-dependencies/issues"
|
|
43
|
+
|
|
44
|
+
[dependency-groups]
|
|
45
|
+
dev = [
|
|
46
|
+
"pre-commit>=4.7.0",
|
|
47
|
+
"pytest>=9.2.0",
|
|
48
|
+
"ruff>=0.17.3",
|
|
49
|
+
]
|
|
50
|
+
|
|
51
|
+
[tool.ruff]
|
|
52
|
+
line-length = 110
|
|
53
|
+
target-version = "py314"
|
|
54
|
+
|
|
55
|
+
[tool.pytest.ini_options]
|
|
56
|
+
testpaths = ["tests"]
|
|
57
|
+
addopts = ["--import-mode=importlib"]
|
|
58
|
+
|
|
59
|
+
[tool.uv.build-backend]
|
|
60
|
+
source-include = [
|
|
61
|
+
"tests/**",
|
|
62
|
+
"docs/**",
|
|
63
|
+
"CHANGELOG.md",
|
|
64
|
+
".python-version",
|
|
65
|
+
]
|
|
@@ -0,0 +1,45 @@
|
|
|
1
|
+
[build-system]
|
|
2
|
+
requires = ["uv_build>=0.13.6,<0.14"]
|
|
3
|
+
build-backend = "uv_build"
|
|
4
|
+
|
|
5
|
+
[project]
|
|
6
|
+
name = "update-dependencies"
|
|
7
|
+
version = "0.1.0"
|
|
8
|
+
description = "Update Python dependencies, GitHub Actions, Docker digests, and pre-commit hooks."
|
|
9
|
+
readme = "README.md"
|
|
10
|
+
requires-python = ">=3.14,<3.15"
|
|
11
|
+
license = "MIT"
|
|
12
|
+
license-files = ["LICENSE"]
|
|
13
|
+
authors = [{name = "Jesse Goodier"}]
|
|
14
|
+
keywords = ["dependencies", "github-actions", "uv", "automation"]
|
|
15
|
+
classifiers = [
|
|
16
|
+
"Development Status :: 3 - Alpha",
|
|
17
|
+
"Environment :: Console",
|
|
18
|
+
"Programming Language :: Python :: 3.14",
|
|
19
|
+
"Topic :: Software Development :: Build Tools",
|
|
20
|
+
]
|
|
21
|
+
dependencies = ["packaging>=26.3", "rich>=15.0.0", "pyyaml>=6.0.3"]
|
|
22
|
+
|
|
23
|
+
[project.optional-dependencies]
|
|
24
|
+
tui = ["questionary>=2.1.1"]
|
|
25
|
+
|
|
26
|
+
[project.scripts]
|
|
27
|
+
update-dependencies = "update_dependencies.cli:main"
|
|
28
|
+
|
|
29
|
+
[project.urls]
|
|
30
|
+
Homepage = "https://github.com/jessegoodier/update-dependencies"
|
|
31
|
+
Issues = "https://github.com/jessegoodier/update-dependencies/issues"
|
|
32
|
+
|
|
33
|
+
[dependency-groups]
|
|
34
|
+
dev = ["pre-commit>=4.7.0", "pytest>=9.2.0", "ruff>=0.17.3"]
|
|
35
|
+
|
|
36
|
+
[tool.ruff]
|
|
37
|
+
line-length = 110
|
|
38
|
+
target-version = "py314"
|
|
39
|
+
|
|
40
|
+
[tool.pytest.ini_options]
|
|
41
|
+
testpaths = ["tests"]
|
|
42
|
+
addopts = ["--import-mode=importlib"]
|
|
43
|
+
|
|
44
|
+
[tool.uv.build-backend]
|
|
45
|
+
source-include = ["tests/**", "docs/**", "CHANGELOG.md", ".python-version"]
|