feat(ci): add scheduled dependency-bump workflows (Renovate-lite) #99

2026-09-07T17:00:00+02:00

lars commented

2026-09-07 17:00:00 +02:00

Adds two Gitea Actions scheduled workflows, each opening/updating one standing pull request (never pushing to master, never opening a Gitea issue) so the existing pull_request CI (lint/format/type-check/tests) gates every change before a human merges:

deps-lock.yml (weekly, Mondays): uv lock --upgrade within the existing pyproject.toml constraints, PR'd on chore/uv-lock-upgrade.
deps-bounds.yml (monthly): raises pyproject.toml upper bounds that have fallen behind the latest PyPI release, re-locks, PR'd on chore/dep-bounds. torch (pinned <2.4 for portal-machine driver support), plotstyle (private index), and the giant[...] self-references are permanently excluded from auto-raising.

Both branches are force-pushed fresh from master each run (no history accumulation, at most one open PR per job), sharing PR-upsert mechanics in deps-pr.sh. Both support workflow_dispatch for manual testing. No changes to ci.yml, release-commit.sh, .bumpversion.toml, or cliff.toml — merging either PR flows through the existing release job unchanged.

Prerequisite: secrets.CI_TOKEN's existing write:repository scope covers everything here — no new scope needed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KhEer5EWzFU6NJi8hTnDe1

Adds two Gitea Actions scheduled workflows, each opening/updating one standing pull request (never pushing to master, never opening a Gitea issue) so the existing `pull_request` CI (lint/format/type-check/tests) gates every change before a human merges: - **`deps-lock.yml`** (weekly, Mondays): `uv lock --upgrade` within the existing `pyproject.toml` constraints, PR'd on `chore/uv-lock-upgrade`. - **`deps-bounds.yml`** (monthly): raises `pyproject.toml` upper bounds that have fallen behind the latest PyPI release, re-locks, PR'd on `chore/dep-bounds`. `torch` (pinned `<2.4` for portal-machine driver support), `plotstyle` (private index), and the `giant[...]` self-references are permanently excluded from auto-raising. Both branches are force-pushed fresh from master each run (no history accumulation, at most one open PR per job), sharing PR-upsert mechanics in `deps-pr.sh`. Both support `workflow_dispatch` for manual testing. No changes to `ci.yml`, `release-commit.sh`, `.bumpversion.toml`, or `cliff.toml` — merging either PR flows through the existing release job unchanged. Prerequisite: `secrets.CI_TOKEN`'s existing `write:repository` scope covers everything here — no new scope needed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01KhEer5EWzFU6NJi8hTnDe1

lars added 1 commit 2026-09-07 17:00:01 +02:00

feat(ci): add scheduled dependency-bump workflows (Renovate-lite)

CI / Sync project version with tag (hand-pushed tags only) (pull_request) Skipped

Details

CI / Publish package to Gitea package registry (pull_request) Skipped

Details

CI / Lint (ruff check) (pull_request) Successful in 1m28s

Details

CI / Type check (ty) (pull_request) Successful in 1m28s

Details

CI / Format (ruff format) (pull_request) Successful in 1m28s

Details

CI / Tests (pull_request) Successful in 3m34s

Details

CI / Release (bump, changelog, badges, tag) on merge to master (pull_request) Skipped

Details

acd2350f51

Adds two Gitea Actions scheduled workflows, each opening/updating one
standing pull request rather than pushing to master or opening an
issue, so the existing pull_request CI (lint/format/type-check/tests)
gates every change before a human merges:

- deps-lock.yml (weekly, Mondays): `uv lock --upgrade` within the
  existing pyproject.toml constraints, PR'd on chore/uv-lock-upgrade.
- deps-bounds.yml (monthly): raises pyproject.toml upper bounds that
  have fallen behind the latest PyPI release, re-locks, PR'd on
  chore/dep-bounds. torch (pinned <2.4 for portal-machine driver
  support), plotstyle (private index), and the giant[...]
  self-references are permanently excluded.

Both branches are force-pushed fresh from master each run (no history
accumulation, at most one open PR per job), sharing PR-upsert
mechanics in deps-pr.sh. Both support workflow_dispatch for manual
testing. No changes to ci.yml, release-commit.sh, .bumpversion.toml,
or cliff.toml — merging either PR flows through the existing release
job unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KhEer5EWzFU6NJi8hTnDe1

lars merged commit d1fb54fd09 into master

2026-09-07 17:05:40 +02:00

lars deleted branch feature/scheduled-dependency-bump

2026-09-07 17:05:40 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: lars/giant#99