WIP

Author: nabobalis

.github/workflows/test_action.yaml

@@ -20,7 +20,7 @@ jobs:
     name: Run action on test file in repo
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Generate version data using local action
         uses: ./
         with:

.github/workflows/test_bench.yml

@@ -15,9 +15,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
-      - uses: prefix-dev/setup-pixi@v0.9.5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: prefix-dev/setup-pixi@5185adfbffb4bd703da3010310260805d89ebb11 # v0.9.6
         with:
-          pixi-version: "v0.49.0"
+          pixi-version: "v0.69.0"
       - run: |
           pixi run test

.github/workflows/update_schedule.yml

@@ -0,0 +1,29 @@
+name: Update SPEC 0 schedule
+
+on:
+  schedule:
+    - cron: "0 0 1 1,4,7,10 *" # Quarterly: 1st Jan, Apr, Jul, Oct
+  workflow_dispatch:
+
+jobs:
+  update-schedule:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: prefix-dev/setup-pixi@5185adfbffb4bd703da3010310260805d89ebb11 # v0.9.6
+        with:
+          pixi-version: "v0.69.0"
+      - name: Generate schedule files
+        run: pixi run generate-schedules
+      - name: Publish schedule as release asset
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          QUARTER="Q$(( ($(date +%-m) - 1) / 3 + 1 ))"
+          YEAR=$(date +%Y)
+          TAG="schedule-${YEAR}-${QUARTER}"
+          gh release create "$TAG" schedule.json schedule.md \
+            --title "SPEC 0 Schedule ${YEAR}-${QUARTER}" \
+            --notes "Quarterly auto-generated SPEC 0 support schedule. Downloaded automatically by spec0-action."

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: cef0300fd0fc4d2a87a85fa2093c6b283ea36f4b # frozen: v5.0.0
+    rev: v6.0.0
     hooks:
       - id: check-added-large-files
       - id: check-ast
@@ -15,19 +15,19 @@ repos:
       - id: mixed-line-ending
       - id: trailing-whitespace
   - repo: https://github.com/rbubley/mirrors-prettier
-    rev: 787fb9f542b140ba0b2aced38e6a3e68021647a3 # frozen: v3.5.3
+    rev: v3.8.3
     hooks:
       - id: prettier
         files: \.(css|html|md|yml|yaml|gql)
         args: [--prose-wrap=preserve]
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 971923581912ef60a6b70dbf0c3e9a39563c9d47 # frozen: v0.11.4
+    rev: v0.15.14
     hooks:
-      - id: ruff
+      - id: ruff-check
         args: ["--fix", "--show-fixes", "--exit-non-zero-on-fix"]
       - id: ruff-format
   - repo: https://github.com/codespell-project/codespell
-    rev: "63c8f8312b7559622c0d82815639671ae42132ac" # frozen: v2.4.1
+    rev: "v2.4.2"
     hooks:
       - id: codespell
 

action.yaml

@@ -2,7 +2,6 @@
 name: "Update SPEC 0 dependencies"
 description: "Update the lower bounds of Python dependencies covered by the Scientific Python SPEC 0 support schedule"
 author: Scientific Python Developers
-
 inputs:
   target_branch:
     description: "Target branch for the pull request"
@@ -15,7 +14,7 @@ inputs:
   create_pr:
     description: "Whether the action should open a PR or not. Set to false for dry-run/testing."
     required: true
-    default: true
+    default: "true"
   commit_msg:
     description: "Commit message for the commit to update the versions. by default 'Drop support for unsupported packages conform SPEC 0'. has no effect if `create_pr` is set to false"
     required: false
@@ -25,39 +24,53 @@ inputs:
     required: false
     default: "chore: Drop support for unsupported packages conform SPEC 0"
   schedule_path:
-    description: "Path to the schedule.json file relative to the project root. If missing, it will be downloaded from the latest release of savente93/SPEC0-schedule"
-    default: "schedule.json"
+    description: "Path to the schedule.json file relative to the project root. If not provided, the schedule bundled with the action is used."
+    required: false
+    default: ""
   token:
-    description: "GitHub token with repo permissions to create pull requests"
-    required: true
-
+    description: "GitHub token with pull-requests write permission to create pull requests. Defaults to the built-in GITHUB_TOKEN."
+    required: false
+  update_all:
+    description: "If set, also update all non-SPEC0 dependencies to versions released within the last N years (e.g., 2)."
+    required: false
+    default: ""
 runs:
   using: "composite"
   steps:
     - name: Checkout code
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Set up Git
       shell: bash
       run: |
         git config user.name "Scientific Python [bot]"
         git config user.email "scientific-python@users.noreply.github.com"
-    - uses: prefix-dev/setup-pixi@1b2de7f3351f171c8b4dfeb558c639cb58ed4ec0 # v0.9.5
+    - uses: prefix-dev/setup-pixi@5185adfbffb4bd703da3010310260805d89ebb11 # v0.9.6
       name: Setup Pixi
       with:
-        pixi-version: v0.49.0
+        pixi-version: v0.69.0
         manifest-path: ${{ github.action_path }}/pyproject.toml
-    - name: Fetch Schedule from release
+    - name: Fetch schedule from release
+      if: ${{ inputs.schedule_path == '' }}
       uses: robinraju/release-downloader@28fc21f50d76778e7023361aa1f863e717d3d56f # v1.13
       with:
-        repository: "savente93/SPEC0-schedule"
+        repository: "scientific-python/spec0-action"
         latest: true
         fileName: "schedule.json"
     - name: Run update script
       shell: bash
       run: |
         set -e
-        echo "Updating ${{ inputs.project_file_name }} using schedule ${{ inputs.schedule_path }}"
-        pixi run --manifest-path ${{ github.action_path }}/pyproject.toml update-dependencies "${{ github.workspace }}/${{ inputs.project_file_name }}" "${{ github.workspace }}/${{ inputs.schedule_path }}"
+        if [ -n "${{ inputs.schedule_path }}" ]; then
+          SCHEDULE_PATH="${{ github.workspace }}/${{ inputs.schedule_path }}"
+        else
+          SCHEDULE_PATH="${{ github.workspace }}/schedule.json"
+        fi
+        echo "Updating ${{ inputs.project_file_name }} using schedule $SCHEDULE_PATH"
+        UPDATE_ALL_FLAG=""
+        if [ -n "${{ inputs.update_all }}" ]; then
+          UPDATE_ALL_FLAG="--update-all ${{ inputs.update_all }}"
+        fi
+        pixi run --manifest-path ${{ github.action_path }}/pyproject.toml update-dependencies "${{ github.workspace }}/${{ inputs.project_file_name }}" "$SCHEDULE_PATH" $UPDATE_ALL_FLAG
     - name: Changes
       id: changes
       shell: bash
@@ -73,7 +86,7 @@ runs:
       if: ${{ fromJSON(inputs.create_pr) && fromJSON(steps.changes.outputs.changes_detected) }}
       uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
       with:
-        token: ${{ inputs.token }}
+        token: ${{ inputs.token || github.token }}
         commit-message: ${{ inputs.commit_msg }}
         title: ${{ inputs.pr_title }}
         body: "This PR was created automatically"

run_spec0_update.py

@@ -7,7 +7,6 @@
     parser = ArgumentParser(
         description="A script to update your project dependencies to be in line with the scientific python SPEC 0 support schedule",
     )
-
     parser.add_argument(
         "toml_path",
         default="pyproject.toml",
@@ -18,24 +17,25 @@
         default="schedule.json",
         help="Path to the schedule json payload. defaults to 'schedule.json'",
     )
-
+    parser.add_argument(
+        "--update-all",
+        type=float,
+        default=None,
+        metavar="YEARS",
+        help="Also update all non-SPEC0 dependencies to versions released within the last YEARS years (e.g., 2).",
+    )
     args = parser.parse_args()
-
     toml_path = Path(args.toml_path)
     schedule_path = Path(args.schedule_path)
-
     if not toml_path.exists():
         raise ValueError(
             f"{toml_path} was supplied as path to project file but it did not exist"
         )
-
     if not schedule_path.exists():
         raise ValueError(
             f"{schedule_path} was supplied as path to schedule file but it did not exist"
         )
-
     project_data = read_toml(toml_path)
     schedule_data = read_schedule(schedule_path)
-    update_pyproject_toml(project_data, schedule_data)
-
+    update_pyproject_toml(project_data, schedule_data, update_all=args.update_all)
     write_toml(toml_path, project_data)

spec0_action/__init__.py

@@ -1,6 +1,8 @@
+import contextlib
 from packaging.specifiers import SpecifierSet
 from typing import Sequence, Dict
 import datetime
+import requests
 
 from spec0_action.versions import repr_spec_set, tighten_lower_bound
 from spec0_action.parsing import (
@@ -13,31 +15,71 @@
     read_toml,
     write_toml,
 )
-from packaging.version import Version
+from packaging.version import Version, InvalidVersion
 
 __all__ = ["read_schedule", "read_toml", "write_toml", "update_pyproject_toml"]
 
+
+def _get_oldest_version_in_window(package: str, years: float) -> Version | None:
+    """
+    Query PyPI, return oldest non-pre release version uploaded within the last ``years`` years.
+    """
+    cutoff = datetime.datetime.now(tz=datetime.timezone.utc) - datetime.timedelta(
+        days=int(365 * years)
+    )
+    try:
+        resp = requests.get(
+            f"https://pypi.org/simple/{package}",
+            headers={"Accept": "application/vnd.pypi.simple.v1+json"},
+            timeout=15,
+        )
+        resp.raise_for_status()
+        data = resp.json()
+    except Exception:
+        return None
+    candidates: list[Version] = []
+    for f in data.get("files", []):
+        parts = f.get("filename", "").split("-")
+        if len(parts) < 2:
+            continue
+        try:
+            ver = Version(parts[1])
+        except InvalidVersion:
+            continue
+        if ver.is_prerelease:
+            continue
+        upload_str = f.get("upload-time", "")
+        upload_time = None
+        for fmt in ["%Y-%m-%dT%H:%M:%S.%fZ", "%Y-%m-%dT%H:%M:%SZ"]:
+            with contextlib.suppress(ValueError):
+                upload_time = datetime.datetime.strptime(upload_str, fmt).replace(
+                    tzinfo=datetime.timezone.utc
+                )
+                break
+        if upload_time is None or upload_time < cutoff:
+            continue
+        candidates.append(ver)
+
+    return min(candidates, default=None)
+
+
 def update_pyproject_dependencies(dependencies: dict, schedule: Dict[str, str]):
     # Iterate by idx because we want to update it inplace
     for i in range(len(dependencies)):
         dep_str = dependencies[i]
         pkg, extras, spec, env = parse_pep_dependency(dep_str)
-
         if isinstance(spec, Url) or pkg not in schedule:
             continue
-
         new_lower_bound = Version(schedule[pkg])
         try:
             spec = tighten_lower_bound(spec or SpecifierSet(), new_lower_bound)
             # Will raise a value error if bound is already tighter, in this case we just do nothing and  continue
         except ValueError:
             continue
-
         if not extras:
             new_dep_str = f"{pkg}{repr_spec_set(spec)}{env or ''}"
         else:
             new_dep_str = f"{pkg}{extras}{repr_spec_set(spec)}{env or ''}"
-
         dependencies[i] = new_dep_str
 
 
@@ -46,17 +88,13 @@ def update_dependency_table(dep_table: dict, new_versions: dict):
         # Don't do anything for pkgs that aren't in our schedule
         if pkg not in new_versions:
             continue
-
         # Like pkg = ">x.y.z,<a"
         if isinstance(pkg_data, str):
             if not is_url_spec(pkg_data):
                 spec = parse_version_spec(pkg_data)
-
                 new_lower_bound = Version(new_versions[pkg])
                 spec = tighten_lower_bound(spec, new_lower_bound)
-
                 dep_table[pkg] = repr_spec_set(spec)
-
             else:
                 # We don't do anything with url spec dependencies
                 continue
@@ -65,18 +103,16 @@ def update_dependency_table(dep_table: dict, new_versions: dict):
             if "path" in pkg_data:
                 # We don't do anything with path dependencies
                 continue
-
             spec = SpecifierSet(pkg_data["version"])
             new_lower_bound = Version(new_versions[pkg])
             spec = tighten_lower_bound(spec, new_lower_bound)
-
             pkg_data["version"] = repr_spec_set(spec)
 
 
 def update_pixi_dependencies(pixi_tables: dict, schedule: Dict[str, str]):
-    if "pypi-dependencies" in pixi_tables: 
+    if "pypi-dependencies" in pixi_tables:
         update_dependency_table(pixi_tables["pypi-dependencies"], schedule)
-    if "dependencies" in pixi_tables: 
+    if "dependencies" in pixi_tables:
         update_dependency_table(pixi_tables["dependencies"], schedule)
 
     if "feature" in pixi_tables:
@@ -86,7 +122,9 @@ def update_pixi_dependencies(pixi_tables: dict, schedule: Dict[str, str]):
 
 
 def update_pyproject_toml(
-    pyproject_data: dict, schedule_data: Sequence[SupportSchedule]
+    pyproject_data: dict,
+    schedule_data: Sequence[SupportSchedule],
+    update_all: float | None = None,
 ):
     now = datetime.datetime.now(datetime.UTC)
     applicable = sorted(
@@ -101,20 +139,31 @@ def update_pyproject_toml(
         # Fill in the latest known requirement (schedule is sorted, newer entries overwrite older)
         for pkg, version in schedule["packages"].items():
             new_version[pkg] = version
-
     if not new_version:
         raise RuntimeError(
             "Could not find schedule that applies to current time, perhaps your schedule is outdated."
         )
-
     if "python" in new_version:
         pyproject_data["project"]["requires-python"] = repr_spec_set(
             parse_version_spec(new_version["python"])
         )
     update_pyproject_dependencies(
         pyproject_data["project"]["dependencies"], new_version
     )
-
     if "tool" in pyproject_data and "pixi" in pyproject_data["tool"]:
         pixi_data = pyproject_data["tool"]["pixi"]
         update_pixi_dependencies(pixi_data, new_version)
+    if update_all is not None:
+        deps = pyproject_data.get("project", {}).get("dependencies", [])
+        for i, dep_str in enumerate(deps):
+            pkg, extras, spec, env = parse_pep_dependency(dep_str)
+            if pkg in new_version or isinstance(spec, Url) or spec is None:
+                continue
+            min_ver = _get_oldest_version_in_window(pkg, update_all)
+            if min_ver is None:
+                continue
+            try:
+                updated = tighten_lower_bound(spec, min_ver)
+                deps[i] = f"{pkg}{extras or ''}{repr_spec_set(updated)}{env or ''}"
+            except ValueError:
+                continue