fix: remediate CVEs for unstructured-api #82
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependabot - Bump libs and cut release | |
| on: | |
| pull_request: | |
| types: | |
| - opened | |
| - reopened | |
| paths: | |
| - 'uv.lock' | |
| - 'pyproject.toml' | |
| jobs: | |
| bump-changelog: | |
| runs-on: opensource-linux-8core | |
| if: ${{ github.actor == 'dependabot[bot]' }} | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Read Python version from .python-version | |
| run: echo "PYTHON_VERSION=$(cat .python-version)" >> $GITHUB_ENV | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v7 | |
| - name: Set up Python ${{ env.PYTHON_VERSION }} | |
| run: uv python install ${{ env.PYTHON_VERSION }} | |
| - name: Dependabot metadata | |
| id: metadata | |
| uses: dependabot/fetch-metadata@v2 | |
| with: | |
| github-token: "${{ secrets.GITHUB_TOKEN }}" | |
| - name: Create release version | |
| run: | | |
| uv lock --upgrade | |
| package=${{ steps.metadata.outputs.dependency-names }} | |
| # Strip any [extras] from name | |
| package=${package%\[*} | |
| changelog_message="Bump $package to ${{ steps.metadata.outputs.new-version }}" | |
| ./scripts/version-increment.sh "$changelog_message" | |
| make version-sync | |
| - uses: stefanzweifel/git-auto-commit-action@v6 | |
| with: | |
| commit_message: "Bump libraries and release" |