kleinanzeigen-bot/.github/workflows/update-python-deps.yml

# SPDX-FileCopyrightText: © Sebastian Thomschke and contributors
# SPDX-License-Identifier: AGPL-3.0-or-later
# SPDX-ArtifactOfProjectHomePage: https://github.com/Second-Hand-Friends/kleinanzeigen-bot/
#
# https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions
name: Update Python Dependencies

on:
  schedule:
    # https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows
    - cron: '0 10 * * *' # daily at 10 a.m.
  workflow_dispatch:
    # https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/

defaults:
  run:
    shell: bash

env:
  PYTHON_VERSION: "3.10"

permissions:
  contents: write
  pull-requests: write

jobs:

  ###########################################################
  update-python-deps:
  ###########################################################
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
    - name: "Show: GitHub context"
      env:
        GITHUB_CONTEXT: ${{ toJSON(github) }}
      run: echo $GITHUB_CONTEXT


    - name: "Show: environment variables"
      run: env | sort


    - name: Generate GitHub Access Token
      uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
      # https://github.com/tibdex/github-app-token
      id: generate_token
      # see https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#authenticating-with-github-app-generated-tokens
      with:
        # see https://github.com/organizations/Second-Hand-Friends/settings/apps/kleinanzeigen-bot-tu
        app_id: ${{ secrets.DEPS_UPDATER_APP_ID }}
        private_key: ${{ secrets.DEPS_UPDATER_PRIVATE_KEY }}


    - name: Git Checkout
      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.0
      # https://github.com/actions/checkout
      with:
        token: ${{ steps.generate_token.outputs.token }}


    - name: "Install: Python and PDM"  # https://github.com/pdm-project/setup-pdm
      uses: pdm-project/setup-pdm@9e87bfc944c539be61c7653113bdb80ea5fe09d6 # v4.4
      with:
        python-version: "${{ env.PYTHON_VERSION }}"
        cache: true


    - name: "Install: Python dependencies"
      run: |
        set -eux

        python --version
        python -m pip install --upgrade pip
        pip install --upgrade pdm
        if [[ ! -e .venv ]]; then
          pdm venv create || true
        fi
        pdm sync --clean -v


    - name: Update Python dependencies 
      id: update_deps
      run: |
        set -euo pipefail
        set -x

        exec 5>&1
        updates=$(pdm update --update-all 2>&1 | tee /dev/fd/5)

        if git diff --exit-code pdm.lock; then
          echo "updates=" >> "$GITHUB_OUTPUT"
        else
          updates="$(echo "$updates" | grep Update | grep -v kleinanzeigen-bot || true)"
          if [[ $(wc -l <<< "$updates") -eq 1 ]]; then
            echo "title=$(echo "$updates" | head -n 1 | sed 's/ successful//')" >> "${GITHUB_OUTPUT}"
          else
            echo "title=Update Python dependencies" >> "${GITHUB_OUTPUT}"
          fi
          # https://github.com/orgs/community/discussions/26288#discussioncomment-3876281
          delimiter="$(openssl rand -hex 8)"
          echo "updates<<${delimiter}" >> "${GITHUB_OUTPUT}"
          echo "$updates" >> "${GITHUB_OUTPUT}"
          echo "${delimiter}" >> "${GITHUB_OUTPUT}"
        fi


    - name: Create PR
      uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.5
      # https://github.com/peter-evans/create-pull-request
      if: "${{ steps.update_deps.outputs.updates != '' }}"
      with:
        title: "chore: ${{ steps.update_deps.outputs.title }}"
        author: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
        committer: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
        commit-message: "chore: ${{ steps.update_deps.outputs.title }}"
        body: ${{ steps.update_deps.outputs.updates }}
        add-paths: pdm.lock
        branch: dependencies/pdm
        delete-branch: true
        token: ${{ steps.generate_token.outputs.token }}