dockerfiles/.github/workflows/update-python.yml at main · jauderho/dockerfiles · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
# updatebot
#
# This runs every hour to check if upstream repos have had a new release
#
name: Update Python

on:
  push:
    branches:
      - main
    paths:
      - scripts/updatePythonDeps.sh
      - .github/workflows/ansible.yml
      - .github/workflows/catprinter.yml
      - .github/workflows/dkimpy.yml
      - .github/workflows/docker-autocompose.yml
      - .github/workflows/ruff.yml
      - .github/workflows/sslyze.yml
      - .github/workflows/visidata.yml
      - .github/workflows/update-python.yml
  workflow_dispatch:
  schedule:
    - cron: "30 3 * * *"

env:
  DOCKER_CLI_EXPERIMENTAL: enabled
  REPOSITORY: ${{ github.actor }}/${{ github.workflow }}

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true

permissions: read-all

jobs:
  update-python:
    strategy:
      fail-fast: false
      matrix:
        app: [ansible, catprinter, dkimpy, docker-autocompose, ruff, sslyze, visidata]
    runs-on: ubuntu-26.04
    permissions:
      id-token: write

    steps:
      # checkout with a PAT configured with workflow access to allow the workflow to check changes back in
      - name: Harden Runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: block
          disable-sudo: false
          disable-telemetry: true
          allowed-endpoints: >
            aerodent.canonical.com:443
            api.github.com:443
            azure.archive.ubuntu.com:80
            files.pythonhosted.org:443
            github.com:443
            objects.githubusercontent.com:443
            pkg-containers.githubusercontent.com:443
            pypi.org:443
            raw.githubusercontent.com:443
            release-assets.githubusercontent.com:443
            releases.astral.sh:443
            security.ubuntu.com:443

      - name: Source checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          token: ${{ secrets.UPDATE_SECRET }}
          fetch-depth: 1

      - name: Install uv
        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          enable-cache: true
#          python-version: 3.14
          cache-dependency-glob: "**/pyproject.toml"

      - name: Setup SSH keys
        env:
          BOT_SSH_PRIVATE_KEY: ${{ secrets.JBOT_SSH_PRIVATE_KEY }}
          BOT_SSH_PUBLIC_KEY: ${{ secrets.JBOT_SSH_PUBLIC_KEY }}
        run: |
          mkdir -m 700 -p ~/.ssh
          echo "$BOT_SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
          echo "$BOT_SSH_PUBLIC_KEY" > ~/.ssh/id_ed25519.pub
          chmod 600 ~/.ssh/id_ed25519
          chmod 644 ~/.ssh/id_ed25519.pub

      - name: Update dependencies (${{ matrix.app }})
        run: |
          git config --global user.name "Jauder Ho Bot"
          git config --global user.email "jauderho-bot@users.noreply.github.com"
          git config --global pull.rebase false
          git config --global user.signingkey ~/.ssh/id_ed25519.pub
          git config --global gpg.format ssh
          git config --global commit.gpgsign true
          PAT="${{ github.actor }}/${{ secrets.UPDATE_SECRET }}" scripts/updatePythonDeps.sh ${{ matrix.app }}
          rm -rf ~/.ssh