dep-version-bump.yml

name: Update Dependency Versions

#######
# Updates versions for dependencies that are otherwise unmanaged by other processes.
#######

on:
  schedule:
    - cron: "0 20 * * SUN"  # Sunday @ 2000 UTC
  workflow_dispatch:
  workflow_call:
    inputs:
      subdirectory:
        description: "Whitespace-delimited list of directories containing pyproject.toml and tox.ini files; defaults to repo's base directory."
        default: ""
        type: string
      filenames:
        description: "Whitespace-delimited list of filenames to evaluate for dependency version bumps; defaults to only tox.ini."
        default: "tox.ini"
        type: string
      create-changenote:
        description: "Defaults 'true' to create a misc changenote in the './changes' directory."
        default: true
        type: boolean
      workflow-repo:
        # Only needed for PRs in other repos wanting to test new workflow changes before they are merged.
        # These inputs should not be specified by another repo on their main branch.
        description: "The repo to use to run additional workflows and actions."
        default: "beeware/.github"
        type: string
      workflow-repo-ref:
        description: "The repo ref to use to run additional workflows and actions."
        default: ""
        type: string
    secrets:
      BRUTUS_PAT_TOKEN:
        required: true

permissions:
  pull-requests: write

env:
  BRANCH_PREFIX: "autoupdates"
  CHANGENOTE_DIR: "./changes"
  FORCE_COLOR: "1"

defaults:
  run:
    shell: bash

jobs:
  dep-version-bump:
    name: Bump Config File Dependencies
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v4.2.2
        with:
          token: ${{ secrets.BRUTUS_PAT_TOKEN }}
          path: "repo"

      - name: Checkout ${{ inputs.workflow-repo }}${{ inputs.workflow-repo-ref && format('@{0}', inputs.workflow-repo-ref) || '' }}
        uses: actions/checkout@v4.2.2
        with:
          repository: ${{ inputs.workflow-repo }}
          ref: ${{ inputs.workflow-repo-ref }}
          path: "beeware-.github"

      - name: Configure git
        working-directory: "repo"
        run: |
          git config user.email "brutus@beeware.org"
          git config user.name "Brutus (robot)"

      - name: Set up Python
        uses: actions/setup-python@v5.3.0
        with:
          python-version: "3.x"

      - name: Install Dependencies
        run: |
          python -m pip install pip --upgrade
          python -m pip install configupdater packaging requests tomlkit --upgrade --upgrade-strategy eager

      - name: Update Versions
        working-directory: "repo"
        run: |
          if [ "${{ inputs.subdirectory }}" == "" ]; then
            python ../beeware-.github/scripts/bump_versions.py --filenames ${{ inputs.filenames }}
          else
            for SUBDIR in ${{ inputs.subdirectory }}; do
              python ../beeware-.github/scripts/bump_versions.py ${SUBDIR} --filenames ${{ inputs.filenames }}
            done
          fi

      - name: PR Needed?
        id: pr
        working-directory: "repo"
        run: |
          if [[ $(git status --porcelain) ]]; then
            echo "needed=true" >> ${GITHUB_OUTPUT}
          else
            echo "needed=false" >> ${GITHUB_OUTPUT}
          fi

      - name: Create Pull Request
        id: created-pr
        if: steps.pr.outputs.needed == 'true'
        uses: peter-evans/create-pull-request@v7.0.5
        with:
          token: ${{ secrets.BRUTUS_PAT_TOKEN }}
          path: "repo"
          title: "Bump dependencies in pyproject.toml and tox.ini"
          branch: "${{ env.BRANCH_PREFIX }}/config-files"
          commit-message: "Bump dependencies in pyproject.toml and tox.ini"
          committer: "Brutus (robot) <brutus@beeware.org>"
          author: "Brutus (robot) <brutus@beeware.org>"
          body: "Bumps versions for dependencies in pyproject.toml and tox.ini."
          labels: "dependencies"

      - name: Add changenote
        if: (inputs.create-changenote == true) && (steps.created-pr.outputs.pull-request-number != '')
        working-directory: "repo"
        run: |
          BRANCH_NAME="${{ env.BRANCH_PREFIX }}/config-files"

          git fetch origin
          git checkout "${BRANCH_NAME}"

          FILENAME="${{ env.CHANGENOTE_DIR }}/${{ steps.created-pr.outputs.pull-request-number }}.misc.rst"
          printf 'The pinned dependencies in pyproject.toml and tox.ini were updated to their latest versions.\n' > "${FILENAME}"

          git add "${FILENAME}"
          git commit -m "Add changenote."
          git push --set-upstream origin "${BRANCH_NAME}"