update-dependencies 0.1.0__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (34) hide show
  1. update_dependencies-0.1.0/.python-version +1 -0
  2. update_dependencies-0.1.0/CHANGELOG.md +12 -0
  3. update_dependencies-0.1.0/LICENSE +21 -0
  4. update_dependencies-0.1.0/PKG-INFO +99 -0
  5. update_dependencies-0.1.0/README.md +77 -0
  6. update_dependencies-0.1.0/docs/configuration.md +148 -0
  7. update_dependencies-0.1.0/docs/github-action.md +99 -0
  8. update_dependencies-0.1.0/pyproject.toml +65 -0
  9. update_dependencies-0.1.0/pyproject.toml.orig +45 -0
  10. update_dependencies-0.1.0/src/update_dependencies/__init__.py +5 -0
  11. update_dependencies-0.1.0/src/update_dependencies/__main__.py +3 -0
  12. update_dependencies-0.1.0/src/update_dependencies/action.py +97 -0
  13. update_dependencies-0.1.0/src/update_dependencies/cli.py +247 -0
  14. update_dependencies-0.1.0/src/update_dependencies/config.py +106 -0
  15. update_dependencies-0.1.0/src/update_dependencies/context.py +50 -0
  16. update_dependencies-0.1.0/src/update_dependencies/discovery.py +72 -0
  17. update_dependencies-0.1.0/src/update_dependencies/ecosystems/__init__.py +1 -0
  18. update_dependencies-0.1.0/src/update_dependencies/ecosystems/actions.py +309 -0
  19. update_dependencies-0.1.0/src/update_dependencies/ecosystems/docker.py +125 -0
  20. update_dependencies-0.1.0/src/update_dependencies/ecosystems/hooks.py +93 -0
  21. update_dependencies-0.1.0/src/update_dependencies/ecosystems/python.py +139 -0
  22. update_dependencies-0.1.0/src/update_dependencies/engine.py +1152 -0
  23. update_dependencies-0.1.0/src/update_dependencies/processes.py +75 -0
  24. update_dependencies-0.1.0/src/update_dependencies/progress.py +68 -0
  25. update_dependencies-0.1.0/src/update_dependencies/reporting.py +47 -0
  26. update_dependencies-0.1.0/src/update_dependencies/runner.py +237 -0
  27. update_dependencies-0.1.0/src/update_dependencies/tui.py +180 -0
  28. update_dependencies-0.1.0/tests/Dockerfile +11 -0
  29. update_dependencies-0.1.0/tests/test_configuration.py +118 -0
  30. update_dependencies-0.1.0/tests/test_hooks_policy.py +51 -0
  31. update_dependencies-0.1.0/tests/test_no_auto_update.py +504 -0
  32. update_dependencies-0.1.0/tests/test_processes.py +42 -0
  33. update_dependencies-0.1.0/tests/test_progress.py +88 -0
  34. update_dependencies-0.1.0/tests/test_runner.py +231 -0
@@ -0,0 +1 @@
1
+ 3.14
@@ -0,0 +1,12 @@
1
+ # Changelog
2
+
3
+ ## 0.1.0
4
+
5
+ - Package the updater with uv_build and a Python 3.14 CLI.
6
+ - Share validated TOML configuration between the CLI and composite GitHub Action.
7
+ - Stage updates before applying; add check mode, JSON reports, and file filters.
8
+ - Separate ecosystem operations and isolate per-run state.
9
+ - Make environment synchronization and build-backend updating opt-in.
10
+ - Add CI, clean artifact installation checks, and PyPI Trusted Publishing.
11
+ - Report stage and per-file progress on stderr with elapsed times and configurable verbosity.
12
+ - Format Python code with a 110-character Ruff line length.
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 Jesse Goodier
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
@@ -0,0 +1,99 @@
1
+ Metadata-Version: 2.4
2
+ Name: update-dependencies
3
+ Version: 0.1.0
4
+ Summary: Update Python dependencies, GitHub Actions, Docker digests, and pre-commit hooks.
5
+ Keywords: dependencies,github-actions,uv,automation
6
+ Author: Jesse Goodier
7
+ License-Expression: MIT
8
+ License-File: LICENSE
9
+ Classifier: Development Status :: 3 - Alpha
10
+ Classifier: Environment :: Console
11
+ Classifier: Programming Language :: Python :: 3.14
12
+ Classifier: Topic :: Software Development :: Build Tools
13
+ Requires-Dist: packaging>=26.3
14
+ Requires-Dist: rich>=15.0.0
15
+ Requires-Dist: pyyaml>=6.0.3
16
+ Requires-Dist: questionary>=2.1.1 ; extra == 'tui'
17
+ Requires-Python: >=3.14, <3.15
18
+ Project-URL: Homepage, https://github.com/jessegoodier/update-dependencies
19
+ Project-URL: Issues, https://github.com/jessegoodier/update-dependencies/issues
20
+ Provides-Extra: tui
21
+ Description-Content-Type: text/markdown
22
+
23
+ # update-dependencies
24
+
25
+ Update Python dependencies and PEP 723 scripts, pin GitHub Actions to commit SHAs,
26
+ refresh Docker image digests, and freeze pre-commit hook revisions.
27
+
28
+ Requires **Python 3.14** (`>=3.14,<3.15`). Development and GitHub Actions also use
29
+ 3.14. Managed repositories may target other Python versions; resolution follows
30
+ their own metadata.
31
+
32
+ ```sh
33
+ uv tool install update-dependencies
34
+ update-dependencies --directory /path/to/repository --dry-run
35
+ update-dependencies --ecosystems python,actions --no-allow-major
36
+ ```
37
+
38
+ Before the first PyPI release, install from this checkout with `uv tool install .`.
39
+ For interactive prompts, install `uv tool install 'update-dependencies[tui]'` and
40
+ run `update-dependencies --tui`.
41
+
42
+ All ecosystems are selected by default. Major updates remain enabled for
43
+ compatibility; set `allow-major = false` for a conservative policy. `NO_AUTO_UPDATE`
44
+ in a same-line or immediately preceding comment preserves individual exclusions.
45
+ Docker `latest` tags are left alone unless explicitly enabled.
46
+
47
+ Progress on stderr shows the current ecosystem, files/lookups, and elapsed times.
48
+ Use `--progress plain` for logs or `--progress off` for quiet runs; JSON output
49
+ stays on stdout.
50
+
51
+ Updates are prepared in a temporary copy before applying changes. Dry runs and
52
+ checks leave target files untouched. Environment installation is opt-in (`--sync`).
53
+ Python updates currently support uv projects/lockfiles and PEP 723 scripts;
54
+ requirements.txt, Poetry, and Pipenv lockfiles are not supported.
55
+
56
+ ## GitHub Action
57
+
58
+ ```yaml
59
+ permissions:
60
+ contents: read
61
+
62
+ steps:
63
+ - uses: actions/checkout@v7
64
+ - uses: jessegoodier/update-dependencies@v0.1.0
65
+ with:
66
+ config: update-dependencies.toml
67
+ dry-run: 'true'
68
+ env:
69
+ GH_TOKEN: ${{ github.token }}
70
+ ```
71
+
72
+ The release reference above becomes usable after the first release is pushed.
73
+ Pin actions to full commit SHAs in production. The Action supports Linux hosted
74
+ runners initially; it installs its own isolated Python tool environment and uses
75
+ the package from the Action revision. It does not commit or open pull requests.
76
+ See [Action usage](docs/github-action.md) and [configuration](docs/configuration.md).
77
+
78
+ ## Development and releases
79
+
80
+ Ruff formats Python code with a line length of 110 characters.
81
+
82
+ ```sh
83
+ uv sync --locked --all-extras
84
+ uv run pytest
85
+ uv run ruff check .
86
+ uv run ruff format --check .
87
+ uv build
88
+ ```
89
+
90
+ `scripts/update_dependencies.py` is a compatibility launcher for an installed
91
+ checkout. Run it with `uv run python scripts/update_dependencies.py --help`.
92
+ The old root filename was moved to avoid shadowing the installed Python package.
93
+
94
+ Release by updating `project.version`, regenerating `uv.lock`, and pushing a
95
+ matching `vX.Y.Z` tag. The release workflow builds, checks, installs, and smoke-tests
96
+ both distribution formats before publishing through PyPI Trusted Publishing.
97
+ Configure the PyPI trusted publisher for this repository, `release.yml`, and the
98
+ `pypi` GitHub environment before publishing. No stored PyPI API token is needed.
99
+ PyPI project-name availability/ownership must be confirmed by the publisher.
@@ -0,0 +1,77 @@
1
+ # update-dependencies
2
+
3
+ Update Python dependencies and PEP 723 scripts, pin GitHub Actions to commit SHAs,
4
+ refresh Docker image digests, and freeze pre-commit hook revisions.
5
+
6
+ Requires **Python 3.14** (`>=3.14,<3.15`). Development and GitHub Actions also use
7
+ 3.14. Managed repositories may target other Python versions; resolution follows
8
+ their own metadata.
9
+
10
+ ```sh
11
+ uv tool install update-dependencies
12
+ update-dependencies --directory /path/to/repository --dry-run
13
+ update-dependencies --ecosystems python,actions --no-allow-major
14
+ ```
15
+
16
+ Before the first PyPI release, install from this checkout with `uv tool install .`.
17
+ For interactive prompts, install `uv tool install 'update-dependencies[tui]'` and
18
+ run `update-dependencies --tui`.
19
+
20
+ All ecosystems are selected by default. Major updates remain enabled for
21
+ compatibility; set `allow-major = false` for a conservative policy. `NO_AUTO_UPDATE`
22
+ in a same-line or immediately preceding comment preserves individual exclusions.
23
+ Docker `latest` tags are left alone unless explicitly enabled.
24
+
25
+ Progress on stderr shows the current ecosystem, files/lookups, and elapsed times.
26
+ Use `--progress plain` for logs or `--progress off` for quiet runs; JSON output
27
+ stays on stdout.
28
+
29
+ Updates are prepared in a temporary copy before applying changes. Dry runs and
30
+ checks leave target files untouched. Environment installation is opt-in (`--sync`).
31
+ Python updates currently support uv projects/lockfiles and PEP 723 scripts;
32
+ requirements.txt, Poetry, and Pipenv lockfiles are not supported.
33
+
34
+ ## GitHub Action
35
+
36
+ ```yaml
37
+ permissions:
38
+ contents: read
39
+
40
+ steps:
41
+ - uses: actions/checkout@v7
42
+ - uses: jessegoodier/update-dependencies@v0.1.0
43
+ with:
44
+ config: update-dependencies.toml
45
+ dry-run: 'true'
46
+ env:
47
+ GH_TOKEN: ${{ github.token }}
48
+ ```
49
+
50
+ The release reference above becomes usable after the first release is pushed.
51
+ Pin actions to full commit SHAs in production. The Action supports Linux hosted
52
+ runners initially; it installs its own isolated Python tool environment and uses
53
+ the package from the Action revision. It does not commit or open pull requests.
54
+ See [Action usage](docs/github-action.md) and [configuration](docs/configuration.md).
55
+
56
+ ## Development and releases
57
+
58
+ Ruff formats Python code with a line length of 110 characters.
59
+
60
+ ```sh
61
+ uv sync --locked --all-extras
62
+ uv run pytest
63
+ uv run ruff check .
64
+ uv run ruff format --check .
65
+ uv build
66
+ ```
67
+
68
+ `scripts/update_dependencies.py` is a compatibility launcher for an installed
69
+ checkout. Run it with `uv run python scripts/update_dependencies.py --help`.
70
+ The old root filename was moved to avoid shadowing the installed Python package.
71
+
72
+ Release by updating `project.version`, regenerating `uv.lock`, and pushing a
73
+ matching `vX.Y.Z` tag. The release workflow builds, checks, installs, and smoke-tests
74
+ both distribution formats before publishing through PyPI Trusted Publishing.
75
+ Configure the PyPI trusted publisher for this repository, `release.yml`, and the
76
+ `pypi` GitHub environment before publishing. No stored PyPI API token is needed.
77
+ PyPI project-name availability/ownership must be confirmed by the publisher.
@@ -0,0 +1,148 @@
1
+ # Configuration
2
+
3
+ Precedence is built-in defaults, repository configuration, then explicit CLI or
4
+ Action inputs. Unset boolean Action inputs inherit config; `false` overrides it.
5
+ List overrides replace the configured list. Unknown keys and invalid values fail
6
+ before any updating begins.
7
+
8
+ Discovery checks `update-dependencies.toml` first, then
9
+ `[tool.update-dependencies]` in `pyproject.toml`. Exactly one file is loaded.
10
+ `--config PATH` selects a file explicitly, relative to `--directory`.
11
+ `--no-config` disables discovery. `--print-config` prints effective JSON without
12
+ network calls. `--directory` defaults to the caller's current working directory.
13
+
14
+ ```toml
15
+ # update-dependencies.toml
16
+ schema-version = 1
17
+ ecosystems = ["python", "actions", "docker", "hooks"]
18
+ allow-major = false
19
+ min-age-hours = 48
20
+ stale-days = 180
21
+ dry-run = false
22
+ check = false
23
+ timeout = 120
24
+ retries = 2
25
+ progress = "auto"
26
+ include = []
27
+ exclude = ["vendor/**", "tests/fixtures/**"]
28
+
29
+ [python]
30
+ inline-scripts = true
31
+ add-missing-minimums = false
32
+ update-build-backend = false
33
+ sync = false
34
+
35
+ [docker]
36
+ pin-latest = false
37
+ ```
38
+
39
+ For `pyproject.toml`, prefix all tables with `tool.update-dependencies`:
40
+
41
+ ```toml
42
+ [tool.update-dependencies]
43
+ allow-major = false
44
+
45
+ [tool.update-dependencies.python]
46
+ inline-scripts = true
47
+ ```
48
+
49
+ | Configuration key | CLI | Default |
50
+ | --- | --- | --- |
51
+ | `schema-version` | Config only | `1` |
52
+ | `ecosystems` | `--ecosystems python,actions` or `--only python` | All four |
53
+ | `allow-major` | `--allow-major` / `--no-allow-major` | `true` |
54
+ | `min-age-hours` | `--min-age HOURS` | `48` |
55
+ | `stale-days` | `--stale-days DAYS` | `180` |
56
+ | `dry-run` | `--dry-run` / `--no-dry-run` | `false` |
57
+ | `check` | `--check` / `--no-check` | `false` |
58
+ | `timeout` | `--timeout SECONDS` | `120` |
59
+ | `retries` | `--retries COUNT` | `2` |
60
+ | `progress` | `--progress auto\|plain\|off` | `auto` |
61
+ | `include` | Repeatable `--include GLOB` | All discovered files |
62
+ | `exclude` | Repeatable `--exclude GLOB` | Empty |
63
+ | `python.inline-scripts` | `--python-inline-scripts` / `--no-python-inline-scripts` | `true` |
64
+ | `python.add-missing-minimums` | `--python-add-minimums` / `--no-python-add-minimums` | `false` |
65
+ | `python.update-build-backend` | `--python-update-build-backend` / `--no-python-update-build-backend` | `false` |
66
+ | `python.sync` | `--sync` / `--no-sync` | `false` |
67
+ | `docker.pin-latest` | `--docker-pin-latest` / `--no-docker-pin-latest` | `false` |
68
+
69
+ Progress is written to stderr, including elapsed time, ecosystem start/completion,
70
+ current files or dependency lookups, retries, validation, and application. `auto`
71
+ adds a spinner in an interactive terminal and emits plain lines in CI or redirected
72
+ logs. `plain` always emits plain lines; `off` disables progress messages. Errors and
73
+ warnings still appear. Long commands remain bounded by the configured timeout;
74
+ progress does not stream subprocess stdout/stderr or change update behavior.
75
+ Use ecosystem completion timings to identify which updates take the most time.
76
+
77
+ `--format text|json` selects console output. `--output PATH` also writes a JSON
78
+ report. `--version` prints the installed package version. `--tui` enables the
79
+ optional interactive interface and seeds its choices from the effective config.
80
+
81
+ Legacy aliases remain: `--no-major-version-updates`,
82
+ `--enable-docker-latest-to-sha-updates`, `--add-python-latest-version`, and
83
+ `--no-update-python-inline-script-metadata`. `--update-docker-tags` is deprecated
84
+ and emits a warning; Docker digest updates have always been the default.
85
+
86
+ ## Policy and scope
87
+
88
+ Python updates cover a root uv project and PEP 723 scripts anywhere under the
89
+ target directory. Requirements files, Poetry, and Pipenv are not supported.
90
+ GitHub updates cover `.github/**/*.yml`, `.github/**/*.yaml`, and all root/nested
91
+ `action.yml` and `action.yaml` files. Docker updates refresh digests for existing
92
+ tags, without choosing newer image tags. Hooks use `pre-commit autoupdate --freeze`.
93
+
94
+ `allow-major = false` holds Python direct dependency major lines using the current
95
+ lock (or a requirement's version floor when no lock exists). For `0.x` dependencies,
96
+ the minor line is held. Bare requirements without a lock cannot be safely held and
97
+ produce an error. Transitive dependencies remain subject to the resolver. Actions
98
+ hold major upgrades and can pin their current ref. Hooks obey the major policy
99
+ when both old and new revisions have version labels; revisions that cannot be
100
+ compared are held when major updates are disabled. Docker digests retain tags.
101
+
102
+ Cooldowns apply to GitHub Action releases, uv Python resolution, PEP 723 resolution,
103
+ and explicit uv_build updates. Docker digests and pre-commit revisions do not have
104
+ a universal release-time source, so `min-age` does not apply to those ecosystems.
105
+ Maintenance age is informational, not a judgment that a project is unmaintained.
106
+
107
+ The build-backend flag independently raises an existing `uv_build` floor within
108
+ its existing bounds. It does not change Docker uv image tags. Adding missing
109
+ Python minimums only affects bare dependency requirements.
110
+
111
+ Git inventory respects tracked files and untracked files not ignored by Git.
112
+ Outside Git, common environment/build directories are excluded. Symlinks are
113
+ skipped. Globs match repository-relative paths using shell-style matching;
114
+ `*` also matches `/`, and leading `**/` can match root files. Filters control
115
+ manifest discovery; paired lockfiles are updated together with their manifests.
116
+ The complete nonignored inventory is copied for resolution so local paths inside
117
+ the repository remain available. Hook updates initialize a fresh staging Git
118
+ repository; original Git history, tags, and worktree metadata are not copied. Paths outside the target directory and external
119
+ Git worktrees are not mirrored; choose the enclosing repository as `--directory`.
120
+ Ignored local dependencies must be made available as nonignored files first.
121
+
122
+ ## Results and failures
123
+
124
+ Exit codes: `0` success (including no applicable files), `1` updates available in
125
+ check mode, `2` configuration/tool/update failure, `130` interruption.
126
+ Explicit `--only` or `--ecosystems` selections fail if an ecosystem has no applicable
127
+ files; automatic defaults report those ecosystems as skipped.
128
+
129
+ JSON reports have `schema_version`, `changed`, `change_count`, `changed_files`,
130
+ `changes`, `skipped`, and `dry_run`. `change_count` counts changed **files**; change
131
+ rows may also contain informational or held updates. Optional maintenance lookups
132
+ can be unavailable without blocking updates. Required resolution errors abort the
133
+ run; no staged changes are applied. Process diagnostics redact credential-like
134
+ environment values and URL passwords.
135
+
136
+ Updates resolve in a temporary copy, validate modified TOML/YAML, and check for
137
+ concurrent target edits before applying. Apply failures attempt to restore written
138
+ files. This is not a crash-safe filesystem transaction: forced termination or a
139
+ machine crash during final writes can leave a partial apply. Existing dirty files
140
+ are treated as the starting point and preserved unless the updater intentionally
141
+ changes them. Text updates retain original CRLF conventions.
142
+
143
+ `--sync` installs the real target environment after successful application. It can
144
+ execute target build machinery; if sync fails, manifest updates remain applied.
145
+ Neither dry-run nor check performs sync. Dependency resolution itself can invoke
146
+ build backends to obtain package metadata; use trusted repository inputs. Registry and subprocess timeouts apply
147
+ per request/command, not to the entire run. Retries apply only to read-only,
148
+ transient lookups; mutating commands are never retried.
@@ -0,0 +1,99 @@
1
+ # GitHub Action
2
+
3
+ The root `action.yml` is a composite action for Linux runners. It installs uv
4
+ 0.13.6 and Python 3.14, installs this Action revision's package and locked runtime
5
+ dependencies into a unique isolated environment, reads configuration, optionally
6
+ sets up Docker Buildx, then runs the same CLI shipped on PyPI.
7
+
8
+ GitHub-hosted Ubuntu includes GitHub CLI and Docker. Self-hosted Linux runners
9
+ must supply Git, GitHub CLI for Actions updates, and Docker for image updates.
10
+ Pre-commit is run through uv's separate tool environment; it does not need to be
11
+ installed in the target project. Registry access is needed to provision tools and
12
+ resolve updates. Docker authentication uses the caller's existing Docker config;
13
+ public ECR lookups use anonymous/public token access.
14
+
15
+ ```yaml
16
+ name: Dependency updates
17
+ on:
18
+ workflow_dispatch:
19
+ schedule:
20
+ - cron: '23 9 * * 1'
21
+ permissions:
22
+ contents: read
23
+ concurrency:
24
+ group: dependency-updates
25
+ cancel-in-progress: false
26
+ jobs:
27
+ update:
28
+ runs-on: ubuntu-latest
29
+ steps:
30
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
31
+ - uses: jessegoodier/update-dependencies@v0.1.0
32
+ id: update
33
+ with:
34
+ config: update-dependencies.toml
35
+ allow-major: 'false'
36
+ dry-run: 'true'
37
+ progress: plain
38
+ env:
39
+ GH_TOKEN: ${{ github.token }}
40
+ ```
41
+
42
+ The first versioned reference becomes available after release. Prefer a full
43
+ release commit SHA for production. The repository's own scheduled workflow uses
44
+ its checked-out action and uploads a preview report. GitHub Actions publishing
45
+ and PyPI publishing are separate: this action can run directly from a repository
46
+ commit even before the first PyPI release.
47
+
48
+ Inputs mirror [configuration CLI options](configuration.md). Every boolean accepts
49
+ `'true'` or `'false'`; empty means inherit. `ecosystems` is comma-separated;
50
+ `include` and `exclude` are newline-separated globs. Runtime-only inputs are
51
+ `directory`, `config`, `no-config`, `format`, and `output`. Interactive prompting,
52
+ printing config, and legacy no-op aliases are intentionally absent from the Action.
53
+ Secrets belong in environment variables (`GH_TOKEN`, registry credentials via a
54
+ login step), not committed TOML or argument strings. The Action passes input
55
+ values through environment variables and constructs Python argument lists.
56
+
57
+ Outputs:
58
+
59
+ | Output | Meaning |
60
+ | --- | --- |
61
+ | `changed` | `true` if files changed or would change in a preview |
62
+ | `change-count` | Changed file count |
63
+ | `changed-files` | JSON array of repository-relative paths |
64
+ | `report-path` | Absolute JSON report path |
65
+
66
+ A default report is written to `$RUNNER_TEMP/update-dependencies-report.json`;
67
+ set `output` for distinct reports when running multiple instances in one job.
68
+ A step summary is written automatically. The `progress` input accepts `auto`,
69
+ `plain`, or `off`, and defaults to inheriting repository configuration. CI progress
70
+ is written as plain stderr lines with elapsed times; JSON stdout remains separate. Check mode returns a failing step when
71
+ updates exist; use `continue-on-error` when the caller intends to inspect that
72
+ outcome and continue.
73
+
74
+ The action edits the checkout when dry-run/check are disabled. It does not commit,
75
+ push, open PRs, or merge changes. A caller can use the report and changed files in
76
+ its own PR workflow, granting write permissions only there. A PR bot token may be
77
+ needed if the resulting PR must trigger other workflows; workflow-file changes
78
+ may require additional token permissions. Run write-enabled updating only on
79
+ trusted branches and never execute untrusted PR code with privileged credentials.
80
+
81
+ ## Release setup
82
+
83
+ Create the `pypi` GitHub environment, and configure PyPI Trusted Publishing with:
84
+
85
+ - PyPI project: `update-dependencies`
86
+ - GitHub owner: `jessegoodier`
87
+ - Repository: `update-dependencies`
88
+ - Workflow: `release.yml`
89
+ - Environment: `pypi`
90
+
91
+ The tagged package version must equal the tag without `v`. Build/test and artifact
92
+ installation occur in a read-only job. Only the separate publish job requests
93
+ `id-token: write`; it downloads the validated artifacts and uses the SHA-pinned
94
+ PyPA publishing action. No permanent API token is configured.
95
+
96
+ Current official references verified during the 2026 migration:
97
+ [uv build backend](https://docs.astral.sh/uv/concepts/build-backend/),
98
+ [GitHub Action metadata](https://docs.github.com/en/actions/reference/workflows-and-actions/metadata-syntax),
99
+ [PyPI Trusted Publishing](https://docs.pypi.org/trusted-publishers/using-a-publisher/).
@@ -0,0 +1,65 @@
1
+ [build-system]
2
+ requires = ["uv_build>=0.13.6,<0.14"]
3
+ build-backend = "uv_build"
4
+
5
+ [project]
6
+ name = "update-dependencies"
7
+ version = "0.1.0"
8
+ description = "Update Python dependencies, GitHub Actions, Docker digests, and pre-commit hooks."
9
+ readme = "README.md"
10
+ requires-python = ">=3.14,<3.15"
11
+ license = "MIT"
12
+ license-files = ["LICENSE"]
13
+ keywords = [
14
+ "dependencies",
15
+ "github-actions",
16
+ "uv",
17
+ "automation",
18
+ ]
19
+ classifiers = [
20
+ "Development Status :: 3 - Alpha",
21
+ "Environment :: Console",
22
+ "Programming Language :: Python :: 3.14",
23
+ "Topic :: Software Development :: Build Tools",
24
+ ]
25
+ dependencies = [
26
+ "packaging>=26.3",
27
+ "rich>=15.0.0",
28
+ "pyyaml>=6.0.3",
29
+ ]
30
+
31
+ [[project.authors]]
32
+ name = "Jesse Goodier"
33
+
34
+ [project.optional-dependencies]
35
+ tui = ["questionary>=2.1.1"]
36
+
37
+ [project.scripts]
38
+ update-dependencies = "update_dependencies.cli:main"
39
+
40
+ [project.urls]
41
+ Homepage = "https://github.com/jessegoodier/update-dependencies"
42
+ Issues = "https://github.com/jessegoodier/update-dependencies/issues"
43
+
44
+ [dependency-groups]
45
+ dev = [
46
+ "pre-commit>=4.7.0",
47
+ "pytest>=9.2.0",
48
+ "ruff>=0.17.3",
49
+ ]
50
+
51
+ [tool.ruff]
52
+ line-length = 110
53
+ target-version = "py314"
54
+
55
+ [tool.pytest.ini_options]
56
+ testpaths = ["tests"]
57
+ addopts = ["--import-mode=importlib"]
58
+
59
+ [tool.uv.build-backend]
60
+ source-include = [
61
+ "tests/**",
62
+ "docs/**",
63
+ "CHANGELOG.md",
64
+ ".python-version",
65
+ ]
@@ -0,0 +1,45 @@
1
+ [build-system]
2
+ requires = ["uv_build>=0.13.6,<0.14"]
3
+ build-backend = "uv_build"
4
+
5
+ [project]
6
+ name = "update-dependencies"
7
+ version = "0.1.0"
8
+ description = "Update Python dependencies, GitHub Actions, Docker digests, and pre-commit hooks."
9
+ readme = "README.md"
10
+ requires-python = ">=3.14,<3.15"
11
+ license = "MIT"
12
+ license-files = ["LICENSE"]
13
+ authors = [{name = "Jesse Goodier"}]
14
+ keywords = ["dependencies", "github-actions", "uv", "automation"]
15
+ classifiers = [
16
+ "Development Status :: 3 - Alpha",
17
+ "Environment :: Console",
18
+ "Programming Language :: Python :: 3.14",
19
+ "Topic :: Software Development :: Build Tools",
20
+ ]
21
+ dependencies = ["packaging>=26.3", "rich>=15.0.0", "pyyaml>=6.0.3"]
22
+
23
+ [project.optional-dependencies]
24
+ tui = ["questionary>=2.1.1"]
25
+
26
+ [project.scripts]
27
+ update-dependencies = "update_dependencies.cli:main"
28
+
29
+ [project.urls]
30
+ Homepage = "https://github.com/jessegoodier/update-dependencies"
31
+ Issues = "https://github.com/jessegoodier/update-dependencies/issues"
32
+
33
+ [dependency-groups]
34
+ dev = ["pre-commit>=4.7.0", "pytest>=9.2.0", "ruff>=0.17.3"]
35
+
36
+ [tool.ruff]
37
+ line-length = 110
38
+ target-version = "py314"
39
+
40
+ [tool.pytest.ini_options]
41
+ testpaths = ["tests"]
42
+ addopts = ["--import-mode=importlib"]
43
+
44
+ [tool.uv.build-backend]
45
+ source-include = ["tests/**", "docs/**", "CHANGELOG.md", ".python-version"]
@@ -0,0 +1,5 @@
1
+ """Dependency updates for repositories, locally and in GitHub Actions."""
2
+
3
+ from importlib.metadata import version
4
+
5
+ __version__ = version("update-dependencies")
@@ -0,0 +1,3 @@
1
+ from .cli import main
2
+
3
+ raise SystemExit(main())