langgraph-aerospike/.github/workflows/upgrade-lock.yml at 296499703f0405085732b0c948f0a87dba7876d5 · aerospike/langgraph-aerospike · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
name: Upgrade uv lockfile

# Refreshes uv.lock every Sunday so transitive dependencies (and any
# security patches that came with them) get pulled in regularly instead
# of only when someone happens to touch deps. The result is opened as a
# PR against `main`, where CI verifies the upgraded versions still pass
# lint, type-check and tests.
#
# Authenticates with a fine-grained PAT (`LOCKFILE_PR_TOKEN`) instead of
# the default GITHUB_TOKEN so the PR is attributed to a real user and
# CI fires on it automatically (PRs opened by GITHUB_TOKEN are blocked
# from triggering other workflows).

on:
  schedule:
    # Sundays at 06:00 UTC. Adjust if you'd rather see the PR
    # land at a different time.
    - cron: "0 6 * * 0"
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  upgrade-lock:
    name: Refresh uv.lock
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Checkout main
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: main
          token: ${{ secrets.LOCKFILE_PR_TOKEN }}

      - name: Install uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
        with:
          enable-cache: true

      - name: Upgrade lockfile
        run: uv lock --upgrade

      - name: Open pull request if lockfile changed
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          token: ${{ secrets.LOCKFILE_PR_TOKEN }}
          base: main
          branch: chore/uv-lock-upgrade
          delete-branch: true
          add-paths: uv.lock
          commit-message: "chore: refresh uv.lock via weekly upgrade"
          title: "chore: weekly uv lockfile upgrade"
          sign-commits: true
          body: |
            Automated weekly run of `uv lock --upgrade`.

            This refreshes `uv.lock` to the latest versions of all
            transitive dependencies allowed by each package's
            `pyproject.toml` constraints, picking up any upstream
            security patches.

            CI on this PR will verify the upgraded dependencies still
            pass lint, type-check, and the Aerospike-backed test
            matrix (Python 3.10 and 3.13). Merge if green; otherwise
            investigate the failing dependency before merging.