ci: Add pixi update script + dependabot (#44)

Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com>

Author: ytausch

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      gh-actions:
+        patterns:
+          - "*"

.github/scripts/check-deps.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+# Check that all dependencies in pixi.toml are also in pyproject.toml.
+# Note: If you add any dependencies which do have a different name on PyPI,
+# you need to adjust this script to address that.
+set -euo pipefail
+
+contains_dependency_all=true
+
+while read -r dependency; do
+    contains_dependency=$(yq -r ".project.dependencies | map(. == \"${dependency}\") | any" pyproject.toml)
+    if [[ $contains_dependency == "false" ]]; then
+        echo "${dependency} not found in pyproject.toml"
+        contains_dependency_all=false
+    fi
+done < <(yq -r '.dependencies | to_entries | .[] | select(.key != "python") | "\(.key)\(.value)"' pixi.toml)
+
+if [[ $contains_dependency_all == "false" ]]; then
+    exit 1
+fi

.github/scripts/sync-deps.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+# Sync explicit dependencies from pixi.lock into requirements.txt
+# Note: If you add any dependencies which do have a different name on PyPI,
+# you need to adjust this script to address that.
+set -euo pipefail
+
+echo "# this file is auto-generated, please make changes in pixi.toml instead" > requirements.txt
+pixi list -e default --explicit --json | jq -r '.[] | select(.name != "python") | "\(.name)==\(.version)"' >> requirements.txt

.github/workflows/ci.yml

@@ -21,3 +21,35 @@ jobs:
             echo "::error::The schema is out of date. Please run 'pixi run schema' and commit the changes."
             exit 1
           fi
+
+  check-requirements-txt:
+    name: Check requirements.txt
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Set up pixi
+        uses: prefix-dev/setup-pixi@fef5c9568ca6c4ff7707bf840ab0692ba3f08293 # v0.9.0
+        with:
+          run-install: false
+      - name: Sync to requirements.txt
+        run: ./.github/scripts/sync-deps.sh
+      - name: Check for changes
+        run: |
+          git diff --exit-code
+          if [ $? -eq 1 ]
+          then
+            echo "::error::The requirements.txt is out of date. Please run './.github/scripts/sync-deps.sh' and commit the changes."
+            exit 1
+          fi
+
+  check-deps:
+    name: Check pixi.toml in sync with pyproject.toml
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Set up pixi
+        uses: prefix-dev/setup-pixi@fef5c9568ca6c4ff7707bf840ab0692ba3f08293 # v0.9.0
+        with:
+          run-install: false
+      - name: Check Dependencies
+        run: ./.github/scripts/check-deps.sh

.github/workflows/update-lockfiles.yml

@@ -0,0 +1,40 @@
+name: Update lockfiles
+permissions:
+  contents: write
+  pull-requests: write
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: 7 5 1 * * # each 1st at 05:07 UTC
+
+jobs:
+  pixi-update:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Set up pixi
+        uses: prefix-dev/setup-pixi@fef5c9568ca6c4ff7707bf840ab0692ba3f08293 # v0.9.0
+        with:
+          run-install: false
+      - name: Update lockfile
+        run: |
+          pixi update --json --no-install | pixi exec pixi-diff-to-markdown >> diff.md
+      - name: Sync to requirements.txt
+        run: ./.github/scripts/sync-deps.sh
+      - name: Create pull request
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: Update dependencies
+          title: Update dependencies
+          body-path: diff.md
+          branch: update-pixi
+          base: main
+          labels: |
+            pixi
+            dependencies
+          delete-branch: true
+          add-paths: |
+            pixi.lock
+            requirements.txt

pixi.toml

@@ -14,7 +14,6 @@ save-version-info = "python -m conda_metadata_app.version_info"
 postinstall-production = "pip install --no-deps --disable-pip-version-check dist/conda_metadata_app-*.whl"
 
 
-# please sync the dependencies with pyproject.toml and requirements.txt
 [dependencies]
 python = "3.12.*"
 pydantic-settings = ">=2.4.0,<3"

pyproject.toml

@@ -16,7 +16,6 @@ classifiers = [
 ]
 requires-python = ">=3.12"
 
-# please sync the dependencies with pixi.toml and requirements.txt
 dependencies = [
   "pydantic-settings>=2.4.0,<3",
   "pydantic>=2.8.2,<3",

requirements.txt

@@ -1,11 +1,12 @@
-# please sync the dependencies with pyproject.toml and pixi.toml
-pydantic-settings==2.10.1
-pydantic==2.11.9
-typing-extensions==4.15.0
-zstandard==0.23.0
-py-rattler==0.7.2
+# this file is auto-generated, please make changes in pixi.toml instead
 conda-forge-metadata==0.11.0
-conda-package-streaming==0.12.0
 conda-oci-mirror==0.2.3
+conda-package-streaming==0.12.0
+pip==25.2
+py-rattler==0.7.2
+pydantic==2.11.9
+pydantic-settings==2.10.1
 streamlit==1.49.1
 streamlit-searchbox==0.1.20
+typing-extensions==4.15.0
+zstandard==0.23.0