add automatic dependency updater #3516
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| name: Dependency updater | ||
|
|
||
| on: | ||
| schedule: | ||
| - cron: '0 0 * * 0' | ||
|
|
||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| concurrency: | ||
| group: deps-updater | ||
| cancel-in-progress: true | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| issue: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| steps: | ||
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | ||
| - name: Update dependencies | ||
| run: build/deps/update-deps.py | ||
|
There was a problem hiding this comment. Hard to understand how that works but I would love to see separate PRs for each dependency, would be easier to deconflict. There was a problem hiding this comment. Basically this will run the shell script, if there are any tracking changes, the next workflow step will execute and it will open a pull-request. There was a problem hiding this comment.
This might be hard to implement since we might have to deduplicate the dependency list in this workflow file as well (to use in matrix) There was a problem hiding this comment. Can we use dependabot instead? There was a problem hiding this comment. AFAICT Dependabot doesn't execute custom scripts (build/deps/update-deps.py). We can use dependabot for package.json, but not for our update-deps related dependencies. I'll open another PR for adding dependabot for package.json There was a problem hiding this comment. We've gotten dependabot PRs before, I think it's already set up in some capacity. |
||
| - name: Open pull request | ||
| uses: peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e #v6.0.5 | ||
| with: | ||
| commit-message: "update dependencies to latest version" | ||
| branch: "automatic-update-deps" | ||
| title: "Update dependencies" | ||
| body: | | ||
| This is an automated pull request for updating the dependencies of workerd. | ||
| delete-branch: true | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We should use tag
@v4, which generally results in using the latest patch release in the 4.x series, as we currently do with various actions in the other workflows. (There are some concerns about specifying a tag as malicious actors could change the tag to point to a different commit as a supply chain attack but this is unlikely with a repo owned by GitHub itself.)