Upgrade uv lockfile #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Upgrade uv lockfile | |
| # Refreshes uv.lock every Sunday so transitive dependencies (and any | |
| # security patches that came with them) get pulled in regularly instead | |
| # of only when someone happens to touch deps. The result is opened as a | |
| # PR against `main`, where CI verifies the upgraded versions still pass | |
| # lint, type-check and tests. | |
| # | |
| # Authenticates with a fine-grained PAT (`LOCKFILE_PR_TOKEN`) instead of | |
| # the default GITHUB_TOKEN so the PR is attributed to a real user and | |
| # CI fires on it automatically (PRs opened by GITHUB_TOKEN are blocked | |
| # from triggering other workflows). | |
| on: | |
| schedule: | |
| # Sundays at 06:00 UTC. Adjust if you'd rather see the PR | |
| # land at a different time. | |
| - cron: "0 6 * * 0" | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| upgrade-lock: | |
| name: Refresh uv.lock | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout main | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| ref: main | |
| token: ${{ secrets.LOCKFILE_PR_TOKEN }} | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | |
| with: | |
| enable-cache: true | |
| - name: Upgrade lockfile | |
| run: uv lock --upgrade | |
| - name: Open pull request if lockfile changed | |
| uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 | |
| with: | |
| token: ${{ secrets.LOCKFILE_PR_TOKEN }} | |
| base: main | |
| branch: chore/uv-lock-upgrade | |
| delete-branch: true | |
| add-paths: uv.lock | |
| commit-message: "chore: refresh uv.lock via weekly upgrade" | |
| title: "chore: weekly uv lockfile upgrade" | |
| sign-commits: true | |
| body: | | |
| Automated weekly run of `uv lock --upgrade`. | |
| This refreshes `uv.lock` to the latest versions of all | |
| transitive dependencies allowed by each package's | |
| `pyproject.toml` constraints, picking up any upstream | |
| security patches. | |
| CI on this PR will verify the upgraded dependencies still | |
| pass lint, type-check, and the Aerospike-backed test | |
| matrix (Python 3.10 and 3.13). Merge if green; otherwise | |
| investigate the failing dependency before merging. |