update-lock.yml

name: Update dependency lock file

on:
  # Run every Monday at 08:00 UTC — picks up upstream patch / security
  # releases that land within the bounded ranges in requirements.txt.
  schedule:
    - cron: "0 8 * * 1"
  # Allow manual trigger from the Actions tab for ad-hoc refreshes.
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  update-lock:
    name: Regenerate requirements-lock.txt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: "3.12"

      - name: Install pip-tools
        run: python -m pip install pip-tools

      - name: Regenerate lock file
        run: |
          pip-compile requirements.txt \
            --output-file requirements-lock.txt \
            --no-header \
            --annotation-style=line \
            --allow-unsafe \
            --upgrade

      - name: Restore header comment
        # pip-compile --no-header omits the auto-generated header line but
        # we maintain our own documentation header; restore it if missing.
        run: |
          HEADER='# Pinned lock file — generated by pip-compile (pip-tools).\n# Install: pip install -r requirements-lock.txt\n# Update:  pip-compile requirements.txt --output-file requirements-lock.txt --no-header --annotation-style=line --allow-unsafe\n# Run periodically (e.g. via the "Update dependency lock file" CI workflow) to pick up\n# upstream patch / security releases within the bounded ranges in requirements.txt.'
          if ! head -1 requirements-lock.txt | grep -q "^#"; then
            printf '%s\n' "$HEADER" | cat - requirements-lock.txt > /tmp/lock.tmp
            mv /tmp/lock.tmp requirements-lock.txt
          fi

      - name: Open PR if lock file changed
        uses: peter-evans/create-pull-request@v7
        with:
          commit-message: "chore: update requirements-lock.txt"
          branch: "chore/update-lock-file"
          delete-branch: true
          title: "chore: update dependency lock file"
          body: |
            Automated weekly refresh of `requirements-lock.txt`.

            Generated by `pip-compile --upgrade` from the bounded specifiers
            in `requirements.txt`. Review the diff to confirm no unexpected
            major-version jumps before merging.
          labels: dependencies