pip-tools.yaml

# Action to run pip-compile weekly and create a Pull Request with the changes.
# Althought GitHub says that pip-compile is supported by dependabot, we couldn't make it work together.
# That's why this action exists.
# If we ever find the proper configuration for dependabot+pip-compile,
# we can delete this action.

name: Update dependencies with pip-tools

on:
  schedule:
    # Run weekly on day 0 at 00:00 UTC
    - cron: "0 0 * * 0"

permissions:
  contents: read

jobs:
  update-dependencies:
    permissions:
      contents: write # to create branch (peter-evans/create-pull-request)
      pull-requests: write # to create a PR (peter-evans/create-pull-request)

    name: Update dependencies
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Update submodules
        run: git submodule update --init
      - uses: actions/setup-python@v4
        with:
          python-version: "3.10"

      - name: Install "pg_config" requirement
        run: sudo apt-get install libpq-dev

      - name: Install piptools and invoke
        run: python -m pip install -U pip-tools invoke

      - name: Update dependencies from requirements/*.txt
        run: invoke requirements.update

      - name: Create Pull Request
        uses: peter-evans/create-pull-request@v5
        with:
          add-paths: |
            requirements/*.txt
          title: |
            Dependencies: all packages updated via pip-tools
          body: |
            Dependencies: all packages updated via pip-tools
          commit-message: |
            Dependencies: all packages updated via pip-tools
          delete-branch: true
          branch: dependencies/pip-tools
          branch-suffix: short-commit-hash