update-workflow

#!/usr/bin/env python3

# Copyright © Michal Čihař <michal@weblate.org>
#
# SPDX-License-Identifier: CC0-1.0

"""Synchronizes GitHub workflows for Weblate repositories."""

import subprocess
import sys

import ruamel.yaml

RUNS_UPDATE = {
    "ubuntu-latest": "ubuntu-24.04",
    "macos-latest": "macos-15",
    "windows-latest": "windows-2025",
}

yaml = ruamel.yaml.YAML()
yaml.indent = 2
yaml.preserve_quotes = False
yaml.width = sys.maxsize

with open(sys.argv[1]) as handle:
    data = yaml.load(handle)

modified = False

if "permissions" not in data:
    data["permissions"] = {"contents": "read"}
    modified = True

if events := data.get("on"):
    # Convert legacy style on list to modern layout
    if isinstance(events, list):
        data["on"] = events = dict.fromkeys(events)
        modified = True
    # Include dependabot in ignored branches to match renovate
    # The dependabot might trigger security updates which renovate does not
    # yet see.
    if (
        (push_event := events.get("push"))
        and (branches := push_event.get("branches-ignore"))
        and "renovate/**" in branches
        and "dependabot/**" not in branches
    ):
        branches.append("dependabot/**")
        modified = True

for job_name in data["jobs"]:
    job = data["jobs"][job_name]

    # Avoid using *-latest OS, pin it instead
    if "runs-on" in job and job["runs-on"] in RUNS_UPDATE:
        job["runs-on"] = RUNS_UPDATE[job["runs-on"]]
        modified = True

    if "steps" in job:
        for step in job["steps"]:
            uses = step.get("uses", "")
            if uses.startswith("actions/checkout@"):
                if "with" not in step:
                    step["with"] = {}
                if "persist-credentials" not in step["with"]:
                    step["with"]["persist-credentials"] = "token" in step["with"]
                    modified = True
            if uses.startswith("astral-sh/setup-uv@"):
                if "with" not in step:
                    step["with"] = {}
                if "version" not in step["with"]:
                    step["with"]["version"] = "0.9.5"
                    modified = True

            # Revert workaround for https://github.com/mgedmin/check-manifest/issues/177
            if step.get("run") == "uvx --with pip check-manifest -v":
                step["run"] = "uvx check-manifest -v"
                modified = True
            if step.get("run", "").startswith("uvx --with pip pyroma"):
                step["run"] = f"uvx {step['run'].removeprefix('uvx --with pip ')}"
                modified = True

if modified:
    with open(sys.argv[1], "w") as handle:
        yaml.dump(data, handle)

    subprocess.run(
        ["uvx", "prek", "run", "--files", sys.argv[1]], check=False, capture_output=True
    )