Package: bumpdeps
ContentsOverviewBackgroundUsageCustomizingCLI ArgumentsUsing BumpDeps with GitHub ActionsConfigure Deploy KeyExample GitHub Actions configurationOverviewBumpDeps is a utility for bumping dependency versions specified inpyproject.tomlfiles.
It attempts to adhere to specifications outlined inPEP 440andPEP 508.BumpDeps can be used as part of a release process or CI workflow to ensure pinned
dependencies do not become outdated.BackgroundTypically, dependency versions should not have upper-bound pinning because this is a deployment
activity. Pinning dependencies moves the implicit security contract from the user to the maintainer.
Instead, automated CI testing should run regularly against the latest versions of dependencies with
any issues resolved quickly. Upper-bound pinning, if required, should be temporary and tied to an
issue or task.So why does this tool exist? There may be cases where pinning is still done. Whether this is for
valid reasons or not, the dependencies in these cases can quickly become outdated. This tool is
intended to simplify the process of updating those dependencies.UsageFor the most basic usage, run bumpdeps in the root of a project.
This will bump the base dependencies found in pyproject.toml.$bumpdepsTo bump optional dependencies, simplify provide the name of the extra.$bumpdepssome_extrasome_cooler_extraTo bump all dependencies, use--allor-a$bumpdeps--allFor more granular options, see below.CustomizingBumpDeps behavior can be customized though the use of in-line comments.If# bumpdeps: ignoreis found after a dependency,
BumpDeps will skip updates for that dependency.If# bumpdeps:ignore-until=YYYY-MM-DDis found after a dependency,
BumpDeps will skip updates for that dependency until the date provided.CLI Argumentsusage: bumpdeps [-h] [-a] [-b] [-i REGEX] [-e REGEX] [-f FILE] [–dry-run] [–pkg-index URL] [-d] [EXTRAS …]-a–allUpdate dependencies for base and all extras-b–baseUpdate base dependencies.This is the default when no extras are provided.
Typically used in combination with specific extras.-n–no-baseDo not update base dependencies.This is intended for use with–allwhen one want to update all optional
dependencies without updating the base dependencies.-i REGEX–include REGEXRegular expression filter. Only dependencies matching the filter will be updated.-e REGEX–exclude REGEXRegular expression filter. Dependencies matching the filter will be skipped.-f FILE–file FILEPath to TOML file. Defaults to pyproject.toml in the current directory.This file is expected to compatible with the pyproject.toml format.–dry-runShow what changes would be made without making any changes.–pkg-index DIRURL of package index. Defaults tohttps://pypi.org.If using a custom URL, it must have an API compatible with PyPI.-d–debugShow debug output-h–helpShow help message and exitUsing BumpDeps with GitHub ActionsConfigure Deploy KeyIt is recommended to create a deploy key. This allows CI tests to run on the pull request created.
If you use the default permissions, the pull request will still be created, but it won’t trigger
CI tests. There are alternative ways to accomplish this. Find more information on thishere.Create an SSH keypair, leave the passphrase blank.$ssh-keygen-ted25519-fgithub_deployThis will create two files in the current directorygithub_deployThe private keygithub_deploy.pubThe public keyAdd the public key (contents of github_deploy.pub) as a deploy key under repo settingsIMPORTANT: check the box for “Allow write access”Instructions for configuring deploy keys can be foundhere.Create a repo secret named PRIVATE_KEY under repo settings with private key
(contents of github_deploy) as the valueInstructions for creating repository secrets can be foundhere.Example GitHub Actions configurationThis example avoids use of third-party actions, however it could be simplified
by utilizingpeter-evens/create-pull-request.name:Update Dependencieson:schedule:# Every Monday at 1 AM-cron:'01**1'jobs:Update_Deps:runs-on:ubuntu-latestname:${{ matrix.name || matrix.args }}strategy:fail-fast:falsematrix:args:[extras_1,extras_2]include:-args:'-b'name:Base Dependencies-args:'-a-itoml.*'name:All TOML libsenv:DEPS_UPDATED:falsesteps:-uses:actions/checkout@v3with:ssh-key:${{ secrets.PRIVATE_KEY }}-name:Install latest Pythonuses:actions/setup-python@v4with:python-version:3.x-name:Install bumpdepsrun:pip install bumpdeps-name:Update depsrun:|set -xbumpdeps ${{ matrix.args }}git diff --quiet || echo "DEPS_UPDATED=true" >> $GITHUB_ENV-name:Create PRenv:GH_TOKEN:${{ github.token }}run:|set -xPR_BRANCH=bumpdeps/$(echo ${{ matrix.name || matrix.args }} | tr ' ' _)_${{ github.run_id }}PR_MSG="BumpDeps: ${{ matrix.name || matrix.args }}"# Configure Gitgit config --global user.name "BumpDeps"git config --global user.email "<>"# Create commit in new branchgit checkout -b $PR_BRANCHgit commit -a -m "$PR_MSG"git --no-pager log -n 2git push -u origin $PR_BRANCH# Create PRgh pr create -B main -H $PR_BRANCH --title "$PR_MSG" --body "Created by Github Action"if:env.DEPS_UPDATED == 'true'