dependencies.yml

name: Dependency Updates

on:
  schedule:
    # Check for dependency updates weekly on Mondays at 8 AM UTC
    - cron: '0 8 * * 1'
  workflow_dispatch:  # Allow manual trigger

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true

env:
  PYTHON_VERSION: '3.9'
  CI: true

permissions:
  contents: write      # Push commits and tags
  pull-requests: write # Create and update PRs

jobs:
  dependency-update:
    name: Update Dependencies
    runs-on: ubuntu-22.04
    timeout-minutes: 20

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Set up development environment
        run: ./scripts/setup-venv.sh

      - name: Check for outdated dependencies
        id: check-deps
        timeout-minutes: 5
        run: |
          source venv/bin/activate
          # Get current dependency state
          poetry show --outdated > outdated-before.txt || true

          if [ -s outdated-before.txt ]; then
            echo "has_updates=true" >> $GITHUB_OUTPUT
            echo "📦 Found outdated dependencies:"
            cat outdated-before.txt
          else
            echo "has_updates=false" >> $GITHUB_OUTPUT
            echo "✅ All dependencies are up to date"
          fi

      - name: Update dependencies
        if: steps.check-deps.outputs.has_updates == 'true'
        timeout-minutes: 10
        run: |
          source venv/bin/activate

          # Update dependencies while respecting version constraints
          poetry update --dry-run > update-plan.txt
          echo "📋 Update plan:"
          cat update-plan.txt

          # Perform the actual update
          poetry update

          # Show what was updated
          poetry show --outdated > outdated-after.txt || true

      - name: Test updated dependencies
        if: steps.check-deps.outputs.has_updates == 'true'
        timeout-minutes: 15
        run: |
          source venv/bin/activate

          # Install with updated dependencies
          poetry install --with dev

          # Run quick validation using Makefile
          make format
          make lint
          make type-check
          make test-unit

      - name: Generate update summary
        if: steps.check-deps.outputs.has_updates == 'true'
        run: |
          cat > dependency-update-summary.md << 'EOF'
          # Dependency Update Summary

          ## Updates Applied

          The following dependencies have been updated:

          ### Before Update
          ```
          EOF

          if [ -f outdated-before.txt ]; then
            cat outdated-before.txt >> dependency-update-summary.md
          fi

          cat >> dependency-update-summary.md << 'EOF'
          ```

          ### After Update
          ```
          EOF

          if [ -f outdated-after.txt ]; then
            cat outdated-after.txt >> dependency-update-summary.md
          else
            echo "All dependencies are now up to date!" >> dependency-update-summary.md
          fi

          cat >> dependency-update-summary.md << 'EOF'
          ```

          ## Validation

          - ✅ Code formatting check passed
          - ✅ Linting passed
          - ✅ Type checking passed
          - ✅ Unit tests passed

          This update has been automatically tested and is ready for review.
          EOF

      - name: Create Pull Request
        if: steps.check-deps.outputs.has_updates == 'true'
        uses: peter-evans/create-pull-request@v5
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          commit-message: |
            chore: update dependencies

            Automated dependency update with validation.
            All tests pass with updated dependencies.
          title: "chore: automated dependency updates"
          body-path: dependency-update-summary.md
          branch: automated-dependency-updates
          delete-branch: true
          labels: |
            dependencies
            automated
          reviewers: |
            zariliv

      - name: Upload update artifacts
        if: steps.check-deps.outputs.has_updates == 'true'
        uses: actions/upload-artifact@v4
        with:
          name: dependency-update-report
          path: |
            outdated-before.txt
            outdated-after.txt
            update-plan.txt
            dependency-update-summary.md