Add automated dependency update workflow with configurable environment variables

[Copilot]

Implements automated Python dependency updates inspired by Next.js's update_react.yml pattern, adapted for Python ecosystem.

Changes

• .github/workflows/update_dependencies.yml: New workflow for dependency management

  • Environment variables: PYTHON_VERSION (3.11), PIP_VERSION (24.0)
  • Scheduled weekly runs + manual dispatch with package/version targeting
  • Explicit permissions (contents: write) per security best practices
  • Precise package matching via ^package[>=<].* regex to prevent substring collisions
  • Error handling for failed version resolution

• docs/workflows.md: Workflow documentation with usage examples

• docs/README.md: Added workflows documentation link

Workflow Behavior

Manual dispatch supports targeted updates:

inputs:
  package: 'numpy'  # Optional: specific package
  version: '1.24.0' # Optional: target version

Scheduled runs check all packages but require manual intervention for updates (bulk updates need review). Updates pushed to automated/update-dependencies-YYYYMMDD branches.

Original prompt

Pull Request: https://github.com/Symphonic-Joules/next.js/blob/copilot/update-environment-variables/.github/workflows/update_react.yml

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

---

Summary by cubic

Add a workflow to check and update Python dependencies weekly or on demand, with optional targeted package updates. Uses PYTHON_VERSION=3.11 and PIP_VERSION=24.0, runs only for JaclynCodes, pushes with GITHUB_TOKEN, adds explicit contents: write permissions, and improves regex matching and error handling.

Add docs/workflows.md and link it from docs/README.md.

^{Written for commit 17eae1b. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 3 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name=".github/workflows/update_dependencies.yml">

<violation number="1" location=".github/workflows/update_dependencies.yml:100">
P2: This sed replacement drops existing upper-bound constraints (e.g., `librosa>=0.11.0,<0.12.0`), so a “latest compatible” update can accidentally loosen requirements and allow incompatible versions. Preserve any trailing constraints instead of replacing the whole line.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: This sed replacement drops existing upper-bound constraints (e.g., librosa>=0.11.0,<0.12.0), so a “latest compatible” update can accidentally loosen requirements and allow incompatible versions. Preserve any trailing constraints instead of replacing the whole line.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/update_dependencies.yml, line 100:

<comment>This sed replacement drops existing upper-bound constraints (e.g., `librosa>=0.11.0,<0.12.0`), so a “latest compatible” update can accidentally loosen requirements and allow incompatible versions. Preserve any trailing constraints instead of replacing the whole line.</comment>

<file context>
@@ -0,0 +1,123 @@
+                exit 1
+              fi
+              # Use word boundaries to match exact package name
+              sed -i "s/^${{ inputs.package }}[>=<].*/${{ inputs.package }}>=\
+          $LATEST/" requirements.txt
+            fi
</file context>

[Copilot]

Pull request overview

Adds a GitHub Actions workflow to (optionally) update Python dependencies and documents the repository’s workflows to make automated maintenance discoverable and repeatable.

Changes:

• Introduces .github/workflows/update_dependencies.yml for scheduled/manual dependency update runs with configurable Python/pip versions.
• Adds docs/workflows.md describing available workflows and how to run dependency updates.
• Links the new workflows documentation from docs/README.md.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

File	Description
.github/workflows/update_dependencies.yml	New automation for checking/updating requirements.txt and pushing update branches.
docs/workflows.md	New documentation describing the dependency update workflow and other existing workflows.
docs/README.md	Adds links to the new workflows documentation.

[Copilot]

If the provided inputs.package doesn't exist in requirements.txt, sed will succeed but make no changes, and the workflow exits with "No changes to commit". That makes it hard to distinguish "already up to date" from "package not found". Add an explicit check that the package line exists/matched (e.g., grep before/after) and fail with a clear error when it isn't found.

[Copilot]

pip list --outdated produces output even when no packages are outdated (e.g., table headers), so checking -s outdated.txt can incorrectly mark updates_available=true and run the update step every time. Prefer a machine-readable format (e.g., --format=json) and explicitly check whether the parsed list is non-empty (or use a format without headers).

Suggested change

	# Check for outdated packages
	echo "Checking for outdated packages..."
	pip list --outdated > outdated.txt
	cat outdated.txt
	if [ -s outdated.txt ]; then
	echo "updates_available=true" >> $GITHUB_OUTPUT
	else
	echo "updates_available=false" >> $GITHUB_OUTPUT
	# Check for outdated packages using machine-readable JSON output
	echo "Checking for outdated packages..."
	pip list --outdated --format=json > outdated.json
	cat outdated.json || true
	updates_count=$(python - << 'PY'
	import json
	import pathlib
	path = pathlib.Path("outdated.json")
	if not path.exists():
	# Treat missing output as no updates
	print(0)
	else:
	try:
	data = json.loads(path.read_text())
	except json.JSONDecodeError:
	# Treat malformed JSON as no updates
	print(0)
	else:
	# data should be a list of outdated packages
	print(len(data) if isinstance(data, list) else 0)
	PY
	)
	if [ "$updates_count" -gt 0 ]; then
	echo "updates_available=true" >> "$GITHUB_OUTPUT"
	else
	echo "updates_available=false" >> "$GITHUB_OUTPUT"

[Copilot]

The workflow installs pip-tools but never uses it afterward. Either remove this install (to reduce runtime/network and simplify the workflow) or actually use pip-tools for compiling/updating requirements if that was the intent.

Suggested change

	# Install pip-tools for dependency management
	pip install pip-tools
	# Check for outdated packages
	# Check for outdated packages using pip

[Copilot]

inputs.package / inputs.version are interpolated directly into shell and sed commands. A crafted input containing quotes/metacharacters can break the command line and execute unintended shell code, especially since this job has contents: write. Validate inputs against an allowlist regex (e.g., [A-Za-z0-9_.-]+), and escape values before using them in sed (or update requirements via a small Python script instead of shell string interpolation).

[Copilot]

The sed replacement overwrites the entire requirement line, which will drop additional constraints (e.g., librosa>=0.11.0,<0.12.0 would lose the <0.12.0 cap). This can unintentionally widen constraints and break compatibility. Consider preserving existing upper bounds/extras, or editing only the specific specifier being updated instead of replacing the whole line.

[JaclynCodes]

:)