add dependency-update workflow template (fixes #683) #756
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| name: Dependency Update | ||
|
Rimsha2535 marked this conversation as resolved.
Collaborator
There was a problem hiding this comment. We also need to add documentation to: To do that, we typically create a sub-page in the relevant area. In this case, we have a nice page that we can add to: Under the section
Collaborator
There was a problem hiding this comment. The Slack token name is
Collaborator
There was a problem hiding this comment. When we add the slack step to the |
||
|
|
||
| on: | ||
| schedule: | ||
| # Every Monday at 03:00 UTC | ||
| - cron: "0 3 * * 1" | ||
| workflow_dispatch: | ||
|
|
||
| jobs: | ||
| dependency-update: | ||
| name: Dependency Update | ||
| runs-on: "ubuntu-24.04" | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
|
|
||
| steps: | ||
| - name: Check out Repository | ||
| id: check-out-repository | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Fail if not running on the default branch | ||
| id: check-branch | ||
| if: github.ref != format('refs/heads/{0}', github.event.repository.default_branch) | ||
| uses: actions/github-script@v8 | ||
| with: | ||
| script: | | ||
| core.setFailed('Not running on the default branch. github.ref is ${{ github.ref }}') | ||
|
|
||
| - name: Set up Python & Poetry Environment | ||
| id: set-up-python-and-poetry-environment | ||
| uses: exasol/python-toolbox/.github/actions/python-environment@v6 | ||
| with: | ||
| python-version: "3.10" | ||
| poetry-version: "2.3.0" | ||
|
|
||
| - name: Audit Dependencies | ||
| id: audit-dependencies | ||
| run: | | ||
| poetry run -- nox -s dependency:audit | tee vulnerabilities.json | ||
| LENGTH=$(jq 'length' vulnerabilities.json) | ||
| echo "count=$LENGTH" >> "$GITHUB_OUTPUT" | ||
|
|
||
| - name: Update Dependencies | ||
| id: update-dependencies | ||
| if: steps.audit-dependencies.outputs.count > 0 | ||
| run: poetry update | ||
|
|
||
| - name: Check for poetry.lock Changes | ||
| id: check-for-poetry-lock-changes | ||
| if: steps.audit-dependencies.outputs.count > 0 | ||
| run: | | ||
| if git diff --quiet -- poetry.lock; then | ||
| echo "changed=false" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "changed=true" >> "$GITHUB_OUTPUT" | ||
| fi | ||
|
|
||
| - name: Configure git | ||
| id: configure-git | ||
| if: steps.check-for-poetry-lock-changes.outputs.changed == 'true' | ||
| run: | | ||
| git config --global user.email "opensource@exasol.com" | ||
| git config --global user.name "Automatic Dependency Updater" | ||
|
|
||
| - name: Create branch | ||
| id: create-branch | ||
| if: steps.check-for-poetry-lock-changes.outputs.changed == 'true' | ||
| run: | | ||
| branch_name="dependency-update/$(date "+%Y%m%d%H%M%S")" | ||
| echo "Creating branch $branch_name" | ||
| git switch -C "$branch_name" | ||
|
|
||
| - name: Commit changes & push | ||
| id: publish-branch | ||
| if: steps.check-for-poetry-lock-changes.outputs.changed == 'true' | ||
| run: | | ||
| branch_name=$(git rev-parse --abbrev-ref HEAD) | ||
| git add poetry.lock | ||
| git commit --message "Update poetry.lock" | ||
| git push --set-upstream origin "$branch_name" | ||
|
|
||
| - name: Create pull request | ||
| id: create-pr | ||
| if: steps.check-for-poetry-lock-changes.outputs.changed == 'true' | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| run: |- | ||
| BASE_BRANCH=$(gh repo view --json defaultBranchRef -q .defaultBranchRef.name) | ||
|
|
||
| gh pr create \ | ||
| --base "$BASE_BRANCH" \ | ||
| --title "Update dependencies to fix vulnerabilities ($(date '+%Y-%m-%d'))" \ | ||
| --body "Automated dependency update for \`poetry.lock\`. | ||
|
|
||
| This PR was created by the dependency update workflow after running: | ||
| - \`poetry run -- nox -s dependency:audit\` | ||
| - \`poetry update\`" | ||
|
ArBridgeman marked this conversation as resolved.
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -59,6 +59,9 @@ Workflows | |
| - Pull request and monthly | ||
| - Executes the continuous integration suite by calling ``merge-gate.yml`` and | ||
| ``report.yml``. See :ref:`ci_yml` for a graph of workflow calls. | ||
| * - ``dependency-update.yml`` | ||
| - Weekly and manual | ||
| - Audits project dependencies for known vulnerabilities, updates them with Poetry when needed, and creates a pull request if the ``poetry.lock`` was changed. | ||
| * - ``gh-pages.yml`` | ||
| - Workflow call | ||
| - Builds the documentation and deploys it to GitHub Pages. | ||
|
|
@@ -97,6 +100,17 @@ Workflows | |
| CI Actions | ||
| ---------- | ||
|
|
||
| Dependency Update | ||
| ^^^^^^^^^^^^^^^^^ | ||
|
|
||
| The ``dependency-update.yml`` workflow is used to resolve vulnerabilities by updating our project dependencies. | ||
|
|
||
| It can be triggered manually and is also scheduled to run weekly. | ||
|
|
||
| The workflow first audits dependencies for known vulnerabilities. If vulnerabilities | ||
| are detected, it updates the dependencies using Poetry. When the ``poetry.lock`` is changed, | ||
| then it creates a pull request with the update. | ||
|
|
||
| .. _ci_yml: | ||
|
|
||
| Pull Request | ||
|
Collaborator
There was a problem hiding this comment. You should also add a changelog entry for this in For adding it to the changelog:
|
||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| name: Dependency Update | ||
|
|
||
| on: | ||
| schedule: | ||
| # Every Monday at 03:00 UTC | ||
| - cron: "0 3 * * 1" | ||
| workflow_dispatch: | ||
|
ArBridgeman marked this conversation as resolved.
|
||
|
|
||
| jobs: | ||
| dependency-update: | ||
| name: Dependency Update | ||
| runs-on: "(( os_version ))" | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
|
|
||
| steps: | ||
| - name: Check out Repository | ||
| id: check-out-repository | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Fail if not running on the default branch | ||
| id: check-branch | ||
| if: github.ref != format('refs/heads/{0}', github.event.repository.default_branch) | ||
| uses: actions/github-script@v8 | ||
| with: | ||
| script: | | ||
| core.setFailed('Not running on the default branch. github.ref is ${{ github.ref }}') | ||
|
|
||
| - name: Set up Python & Poetry Environment | ||
| id: set-up-python-and-poetry-environment | ||
| uses: exasol/python-toolbox/.github/actions/python-environment@v6 | ||
| with: | ||
| python-version: "(( minimum_python_version ))" | ||
| poetry-version: "(( dependency_manager_version ))" | ||
|
|
||
| - name: Audit Dependencies | ||
| id: audit-dependencies | ||
| run: | | ||
| poetry run -- nox -s dependency:audit | tee vulnerabilities.json | ||
| LENGTH=$(jq 'length' vulnerabilities.json) | ||
| echo "count=$LENGTH" >> "$GITHUB_OUTPUT" | ||
|
|
||
| - name: Update Dependencies | ||
| id: update-dependencies | ||
| if: steps.audit-dependencies.outputs.count > 0 | ||
| run: poetry update | ||
|
|
||
| - name: Check for poetry.lock Changes | ||
| id: check-for-poetry-lock-changes | ||
| if: steps.audit-dependencies.outputs.count > 0 | ||
| run: | | ||
| if git diff --quiet -- poetry.lock; then | ||
| echo "changed=false" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "changed=true" >> "$GITHUB_OUTPUT" | ||
| fi | ||
|
|
||
| - name: Configure git | ||
| id: configure-git | ||
| if: steps.check-for-poetry-lock-changes.outputs.changed == 'true' | ||
| run: | | ||
| git config --global user.email "opensource@exasol.com" | ||
| git config --global user.name "Automatic Dependency Updater" | ||
|
|
||
| - name: Create branch | ||
| id: create-branch | ||
| if: steps.check-for-poetry-lock-changes.outputs.changed == 'true' | ||
| run: | | ||
| branch_name="dependency-update/$(date "+%Y%m%d%H%M%S")" | ||
| echo "Creating branch $branch_name" | ||
| git switch -C "$branch_name" | ||
|
|
||
| - name: Commit changes & push | ||
| id: publish-branch | ||
| if: steps.check-for-poetry-lock-changes.outputs.changed == 'true' | ||
| run: | | ||
| branch_name=$(git rev-parse --abbrev-ref HEAD) | ||
| git add poetry.lock | ||
| git commit --message "Update poetry.lock" | ||
| git push --set-upstream origin "$branch_name" | ||
|
|
||
| - name: Create pull request | ||
| id: create-pr | ||
| if: steps.check-for-poetry-lock-changes.outputs.changed == 'true' | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| run: | | ||
| BASE_BRANCH=$(gh repo view --json defaultBranchRef -q .defaultBranchRef.name) | ||
|
|
||
| gh pr create \ | ||
|
Rimsha2535 marked this conversation as resolved.
|
||
| --base "$BASE_BRANCH" \ | ||
| --title "Update dependencies to fix vulnerabilities ($(date '+%Y-%m-%d'))" \ | ||
| --body "Automated dependency update for \`poetry.lock\`. | ||
|
|
||
| This PR was created by the dependency update workflow after running: | ||
| - \`poetry run -- nox -s dependency:audit\` | ||
| - \`poetry update\`" | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.