Metadata-Version: 2.4
Name: update-dependencies
Version: 0.1.2
Summary: Update Python dependencies, GitHub Actions, Docker digests, and pre-commit hooks.
Keywords: dependencies,github-actions,uv,automation
Author: Jesse Goodier
License-Expression: MIT
License-File: LICENSE
Classifier: Development Status :: 3 - Alpha
Classifier: Environment :: Console
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: Software Development :: Build Tools
Requires-Dist: packaging>=26.3
Requires-Dist: rich>=15.0.0
Requires-Dist: pyyaml>=6.0.3
Requires-Dist: questionary>=2.1.1 ; extra == 'tui'
Requires-Python: >=3.14, <3.15
Project-URL: Homepage, https://github.com/jessegoodier/update-dependencies
Project-URL: Issues, https://github.com/jessegoodier/update-dependencies/issues
Provides-Extra: tui
Description-Content-Type: text/markdown

# update-dependencies

Update Python dependencies and PEP 723 scripts, pin GitHub Actions to commit SHAs,
refresh Docker image digests, and freeze pre-commit hook revisions.

Requires **Python 3.14** (`>=3.14,<3.15`). Development and GitHub Actions also use
3.14. Managed repositories may target other Python versions; resolution follows
their own metadata.

```sh
uv tool install update-dependencies
update-dependencies --directory /path/to/repository --dry-run
update-dependencies --ecosystems python,actions --no-allow-major
```

Before the first PyPI release, install from this checkout with `uv tool install .`.
For interactive prompts, install `uv tool install 'update-dependencies[tui]'` and
run `update-dependencies --tui`.

All ecosystems are selected by default. Major updates remain enabled for
compatibility; set `allow-major = false` for a conservative policy. `NO_AUTO_UPDATE`
in a same-line or immediately preceding comment preserves individual exclusions.
Docker `latest` tags are left alone unless explicitly enabled.

Interactive CLI runs use Rich colors and dependency tables. Add `--plain` for
unstyled logs, or configure `plain = true`. The GitHub Action defaults to plain
output; JSON remains unchanged.

Progress on stderr shows the current ecosystem, files/lookups, and elapsed times.
Use `--progress plain` for logs or `--progress off` for quiet runs; JSON output
stays on stdout.

Updates are prepared in a temporary copy before applying changes. Dry runs and
checks leave target files untouched. Environment installation is opt-in (`--sync`).
Python updates currently support uv projects/lockfiles and PEP 723 scripts;
requirements.txt, Poetry, and Pipenv lockfiles are not supported.

## GitHub Action

```yaml
permissions:
  contents: read

steps:
  - uses: actions/checkout@v7
  - uses: jessegoodier/update-dependencies@v0.1.0
    with:
      config: update-dependencies.toml
      dry-run: 'true'
    env:
      GH_TOKEN: ${{ github.token }}
```

The release reference above becomes usable after the first release is pushed.
Pin actions to full commit SHAs in production. The Action supports Linux hosted
runners initially; it installs its own isolated Python tool environment and uses
the package from the Action revision. It does not commit or open pull requests.
See [Action usage](docs/github-action.md) and [configuration](docs/configuration.md).

## Development and releases

Ruff formats Python code with a line length of 110 characters.

```sh
uv sync --locked --all-extras
uv run pytest
uv run ruff check .
uv run ruff format --check .
go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
uv build
uv run python .github/scripts/verify_dist.py
```

`scripts/update_dependencies.py` is a compatibility launcher for an installed
checkout. Run it with `uv run python scripts/update_dependencies.py --help`.
The old root filename was moved to avoid shadowing the installed Python package.

Start a release from **Actions → Release → Run workflow** on the default branch.
Choose **patch** (default), **minor**, or **major**. After validation, automation
opens a version PR. After you merge it and default-branch CI passes, automation
tags the tested merged commit, publishes through the protected `pypi` environment,
then creates the GitHub release. See [release setup](docs/releasing.md)
for GitHub permissions, approval, and retry steps.
