ci: add workflow to refreeze image deps

Author: consideRatio

.github/workflows/watch-dependencies.yaml

@@ -87,3 +87,35 @@ jobs:
           body: >-
             A new ${{ matrix.repository }} image version has been detected, version
             `${{ steps.latest.outputs.tag }}`.
+
+  refreeze-dockerfile-requirements-txt:
+    # Don't run this job on forks, but also not on the daily schedule to reduce
+    # noise. If we could run this weekly that would be reasonable, but updating
+    # these dependencies every day is too much noise.
+    #
+    if: github.repository == 'jupyterhub/binderhub' && github.event_name != 'schedule'
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Refreeze helm-chart/images/binderhub/requirements.txt based on requirements.in
+        run: ci/refreeze
+
+      - name: git diff
+        run: git --no-pager diff --color=always
+
+      # ref: https://github.com/peter-evans/create-pull-request
+      - name: Create a PR
+        uses: peter-evans/create-pull-request@v4
+        with:
+          token: "${{ secrets.jupyterhub_bot_pat }}"
+          author: JupyterHub Bot Account <[email protected]>
+          committer: JupyterHub Bot Account <[email protected]>
+          branch: update-image-requirements
+          labels: dependencies
+          commit-message: "binderhub image: refreeze requirements.txt"
+          title: "binderhub image: refreeze requirements.txt"
+          body: >-
+            The binderhub image's requirements.txt has been refrozen based on
+            requirements.in.

ci/refreeze

@@ -0,0 +1,14 @@
+#!/bin/bash
+set -xeuo pipefail
+
+# Because `pip-compile` resolves `requirements.txt` with the current
+# Python for the current platform, it should be run on the same Python
+# version and platform as our Dockerfile.
+
+docker run --rm \
+    --env=CUSTOM_COMPILE_COMMAND='Use the "Run workflow" button at https://github.com/jupyterhub/binderhub/actions/workflows/watch-dependencies.yaml' \
+    --volume="$PWD:/io" \
+    --workdir=/io \
+    --user=root \
+    python:3.9-bullseye \
+    sh -c 'pip install pip-tools==6.* && pip-compile --upgrade helm-chart/images/binderhub/requirements.in'

helm-chart/images/binderhub/README.md

@@ -7,33 +7,5 @@ Built with [chartpress][].
 
 ## Updating requirements.txt
 
-Dependencies are specified in `requirements.in` and `requirements.txt`,
-which are managed by [`pip-compile`][].
-
-[pip-compile]: https://pip-tools.readthedocs.io
-
-`requirements.in` contains our loosely specified direct requirements.
-This is the file we edit to change what should be in the image.
-
-`requirements.txt` is the fully pinned exact set of packages and versions.
-This file is generated by `pip-compile` and should not be edited.
-
-Because `pip-compile` resolves `requirements.txt` with the current Python for the current platform,
-it must be run on the same Python version and platform as our Dockerfile.
-This can be done from anywhere, by running `pip-compile` in docker from the top-level of the binderhub repo:
-
-```shell
-docker run --rm \
-    --env=CUSTOM_COMPILE_COMMAND="see README.md" \
-    --volume=$PWD:/io \
-    --workdir=/io/helm-chart/images/binderhub \
-    --user=root \
-    python:3.9-slim-bullseye \
-    sh -c 'pip install pip-tools==6.* && pip-compile --upgrade'
-```
-
-or you can just run `CUSTOM_COMPILE_COMMAND="see README.md" pip-compile --upgrade` if you are already using Python 3.9 on linux.
-
-See the [pip-compile docs][updating] for options to control the upgrading of packages.
-
-[updating]: https://pip-tools.readthedocs.io/en/latest/#updating-requirements
+Use the "Run workflow" button at
+https://github.com/jupyterhub/binderhub/actions/workflows/watch-dependencies.yaml.