update-dependencies.yml

---
name: Update Dependencies

on:
  schedule:
    # Run every Monday at 9:00 AM UTC (1:00 AM PST / 2:00 AM PDT)
    - cron: "0 9 * * 1"
  workflow_dispatch:
    inputs:
      update_python:
        description: "Update Python version"
        required: false
        type: boolean
        default: false
      python_version:
        description: "Python version (if updating)"
        required: false
        type: string
        default: "3.13"
      major_upgrades:
        description: "Include major version upgrades"
        required: false
        type: boolean
        default: false

permissions:
  contents: write
  pull-requests: write

jobs:
  update-dependencies:
    runs-on: ubuntu-latest

    steps:
      - name: 🔀 Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: 🔧 Setup Python and UV
        uses: ./.github/actions/setup-python-uv
        with:
          python-version: "3.13"

      - name: 🔧 Setup Just
        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0

      # hadolint is required by the `just lint` pre-commit hook invoked
      # indirectly from scripts/update-project.sh. Mirrors code-quality.yml.
      - name: 🔧 Install hadolint
        uses: alexellis/arkade-get@1eef818e467c387d3f50cfe0d2c565d1cbe82b03 # master
        with:
          hadolint: latest

      - name: 🔧 Configure git
        run: |
          git config --local user.email "github-actions[bot]@users.noreply.github.com"
          git config --local user.name "github-actions[bot]"

      - name: 🚀 Run update script
        id: update
        env:
          UPDATE_PYTHON: ${{ github.event.inputs.update_python }}
          PYTHON_VERSION_INPUT: ${{ github.event.inputs.python_version }}
          MAJOR_UPGRADES: ${{ github.event.inputs.major_upgrades }}
        run: |
          # Validate python version input if provided
          if [[ "$UPDATE_PYTHON" == "true" ]]; then
            if [[ ! "$PYTHON_VERSION_INPUT" =~ ^[0-9]+\.[0-9]+$ ]]; then
              echo "❌ Invalid python version: $PYTHON_VERSION_INPUT"
              exit 1
            fi
          fi

          # Build command arguments
          CMD_ARGS=(--no-backup)
          [[ "$UPDATE_PYTHON" == "true" ]] && CMD_ARGS+=(--python "$PYTHON_VERSION_INPUT")
          [[ "$MAJOR_UPGRADES" == "true" ]] && CMD_ARGS+=(--major)

          # Run the update script and tee output to a file for later steps.
          # Do NOT propagate full output via $GITHUB_OUTPUT — multi-MB output
          # gets embedded into env/args of downstream steps and hits the OS
          # E2BIG limit ("Argument list too long"). The artifact upload step
          # preserves the full log for debugging.
          set +e
          ./scripts/update-project.sh "${CMD_ARGS[@]}" 2>&1 | tee update-output.txt
          EXIT_CODE=${PIPESTATUS[0]}
          set -e

          # Check if changes were made
          if git diff --quiet; then
            echo "no_changes=true" >> "$GITHUB_OUTPUT"
          else
            echo "no_changes=false" >> "$GITHUB_OUTPUT"
          fi

          # Exit with same code as update script
          exit "$EXIT_CODE"

      - name: 📊 Extract update summary
        if: steps.update.outputs.no_changes != 'true'
        id: summary
        run: |
          # Extract relevant sections from output
          SUMMARY=$(awk '/Update Summary/,/Next Steps/' update-output.txt | head -n -1)

          # Count changes
          PACKAGE_COUNT=$(echo "$SUMMARY" | grep -c "•" || echo "0")

          # Create PR title
          PR_TITLE="chore: update dependencies"

          if echo "$SUMMARY" | grep -q "Python Version:"; then
            PYTHON_VER=$(echo "$SUMMARY" | grep "Python Version:" -A1 | tail -1 | awk '{print $NF}')
            PR_TITLE="$PR_TITLE (Python $PYTHON_VER)"
          fi

          if echo "$SUMMARY" | grep -q "UV Package Manager:"; then
            UV_VER=$(echo "$SUMMARY" | grep "UV Package Manager:" -A1 | tail -1 | awk '{print $NF}')
            PR_TITLE="$PR_TITLE (UV $UV_VER)"
          fi

          if [[ "$PACKAGE_COUNT" -gt 0 ]]; then
            PR_TITLE="$PR_TITLE ($PACKAGE_COUNT packages)"
          fi

          echo "pr_title=$PR_TITLE" >> "$GITHUB_OUTPUT"

          # Save summary for PR body
          echo "$SUMMARY" > summary.txt
          {
            echo "summary<<ENDOFSUMMARY"
            echo "$SUMMARY"
            echo "ENDOFSUMMARY"
          } >> "$GITHUB_OUTPUT"

      - name: 📤 Upload update logs
        if: always() && steps.update.outputs.no_changes != 'true'
        uses: actions/upload-artifact@v7
        with:
          name: update-logs
          path: |
            update-output.txt
            summary.txt
          retention-days: 30
          if-no-files-found: ignore

      - name: 🧹 Clean up temporary files
        if: steps.update.outputs.no_changes != 'true'
        run: rm -f update-output.txt summary.txt

      - name: 📝 Create Pull Request
        if: steps.update.outputs.no_changes != 'true'
        id: create-pr
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v.8.1.1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          branch: automation/updates
          delete-branch: true
          title: ${{ steps.summary.outputs.pr_title }}
          body: |
            ## 🤖 Automated Dependency Update

            This PR was automatically generated by the weekly dependency update workflow.

            ### 📊 Update Summary

            ```
            ${{ steps.summary.outputs.summary }}
            ```

            ### 📋 Changes Made

            - ✅ Updated dependencies to latest compatible versions
            - 🔒 All security patches applied
            - 🧪 Tests have been run automatically

            ### 🔍 Manual Verification Required

            Before merging, please:

            1. **Review dependency changes**: Check the Files tab for `uv.lock` changes
            2. **Check CI status**: Ensure all checks pass
            3. **Test locally** (optional):
               ```bash
               git checkout automation/updates
               docker-compose build --no-cache
               docker-compose up -d
               docker-compose ps  # All services should be "healthy"
               ```
            4. **Review security advisories**:
               ```bash
               uv run pip-audit
               ```

            ### 📝 Notes

            - This update was triggered by: ${{ github.event_name }}
            - Major upgrades: ${{ github.event.inputs.major_upgrades || 'false' }}
            - Python update: ${{ github.event.inputs.update_python || 'false' }}

            ---

            Full update output is available as a workflow artifact
            (`update-logs`) on the run that created this PR.
          commit-message: |
            chore: update dependencies

            - Update Python packages to latest compatible versions
            - Update UV package manager in Dockerfiles
            - Apply security patches and bug fixes

            Generated by automated dependency update workflow
          assignees: SimplicityGuy
          reviewers: SimplicityGuy
          draft: false

      - name: 📊 Summary
        if: always()
        env:
          NO_CHANGES: ${{ steps.update.outputs.no_changes }}
          UPDATE_OUTCOME: ${{ steps.update.outcome }}
          PR_URL: ${{ steps.create-pr.outputs.pull-request-url }}
        run: |
          if [[ "$NO_CHANGES" == "true" ]]; then
            echo "✅ All dependencies are already up to date!"
          elif [[ "$UPDATE_OUTCOME" == "success" ]]; then
            echo "✅ Successfully created PR with dependency updates"
            echo "🔗 Review the PR: $PR_URL"
          else
            echo "❌ Failed to update dependencies — see the 'update-logs' artifact for details"
            if [[ -f update-output.txt ]]; then
              echo "--- tail of update-output.txt ---"
              tail -n 100 update-output.txt
            fi
          fi

      - name: 📢 Send notification to Discord
        uses: sarisia/actions-status-discord@eb045afee445dc055c18d3d90bd0f244fd062708 # v1.16.0
        if: always()
        with:
          title: Weekly Dependency Update
          description: |
            ${{ steps.update.outputs.no_changes == 'true' && '✅ All dependencies are already up to date!' ||
                (steps.create-pr.conclusion == 'success' &&
                 format('✅ Successfully created PR with dependency updates\n🔗 [Review PR]({0})',
                        steps.create-pr.outputs.pull-request-url) ||
                 '❌ Failed to update dependencies') }}
          webhook: ${{ secrets.DISCORD_WEBHOOK }}