Replace check for dependabot PRs with check for dependency constraint changes

Author: simonwgill

.github/workflows/04_cron_release.yml

@@ -17,6 +17,14 @@ jobs:
         with:
           fetch-depth: 0 # Fetch all history for tags and commits
 
+      - name: Setup Just
+        uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b
+
+      - name: Setup uv
+        uses: citizensadvice/python-uv-setup-action@dac93858ee327eb09052711b17803ecdfa4da10b
+        with:
+          python_version: 3.13
+
       - name: Check if release PR is needed
         id: check
         run: |
@@ -38,26 +46,20 @@ jobs:
 
           echo "Days since last release: $days_since_release"
 
-          # Check if there are dependabot commits since the last tag
-          dependabot_commits=$(git log "$latest_tag"..HEAD --author="dependabot\[bot\]" --oneline)
-          dependabot_count=$(echo "$dependabot_commits" | grep -c . || echo "0")
-
-          echo "Dependabot commits since last tag: $dependabot_count"
-          if [ "$dependabot_count" -gt 0 ]; then
-            echo "Dependabot commits:"
-            echo "$dependabot_commits"
-          fi
+          # Check if main dependencies have changed using the Justfile command
+          # This command outputs "true" or "false"
+          deps_changed=$(just ci-check-deps-changed "$latest_tag")
 
           # Cooldown period: 4 days
           cooldown_days=4
 
-          if [ "$dependabot_count" -gt 0 ] && [ "$days_since_release" -ge "$cooldown_days" ]; then
+          if [ "$deps_changed" = "true" ] && [ "$days_since_release" -ge "$cooldown_days" ]; then
             echo "should_create_pr=true" >> $GITHUB_OUTPUT
-            echo "Release conditions met: dependabot updates exist and cooldown period passed"
+            echo "Release conditions met: dependencies changed and cooldown period passed"
           else
             echo "should_create_pr=false" >> $GITHUB_OUTPUT
-            if [ "$dependabot_count" -eq 0 ]; then
-              echo "No dependabot commits since last release"
+            if [ "$deps_changed" = "false" ]; then
+              echo "No dependency changes since last release"
             else
               echo "Cooldown period not met (need $cooldown_days days, only $days_since_release passed)"
             fi

Justfile

@@ -60,6 +60,35 @@ _create_draft_release:
 get-version:
     @uv version --short
 
+# CI-only: Check if main dependencies have changed since a git ref (e.g., tag)
+# Outputs "true" if dependencies changed, "false" if no changes. Always exits 0.
+[group("release")]
+ci-check-deps-changed ref:
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    # Create a temporary directory and ensure cleanup
+    tmpdir=$(mktemp -d)
+    trap 'rm -rf "$tmpdir"' EXIT
+
+    # Extract [project.dependencies] section from the ref version
+    git show "{{ ref }}:pyproject.toml" > "$tmpdir/pyproject.old.toml" || exit 1
+    # Extract the dependencies array (everything between 'dependencies = [' and the closing ']')
+    awk '/^dependencies = \[/,/^\]/' "$tmpdir/pyproject.old.toml" | sort > "$tmpdir/deps.old"
+
+    # Extract [project.dependencies] section from current HEAD
+    awk '/^dependencies = \[/,/^\]/' pyproject.toml | sort > "$tmpdir/deps.new"
+
+    # Compare the dependency constraint lists
+    if ! diff -q "$tmpdir/deps.old" "$tmpdir/deps.new" > /dev/null 2>&1; then
+        echo "Dependency constraints have changed since {{ ref }}:" >&2
+        diff "$tmpdir/deps.old" "$tmpdir/deps.new" >&2 || true
+        echo "true"
+    else
+        echo "No changes to dependency constraints since {{ ref }}" >&2
+        echo "false"
+    fi
+
 # CI-only: Configure git for automated commits
 [group("release")]
 ci-configure-git: