Automate dependency updates and releases

.github/workflows/auto-release.yml

@@ -0,0 +1,22 @@
+name: Auto-Release
+
+on:
+  pull_request:
+    types:
+      - closed
+    branches:
+      - main
+
+jobs:
+  ci:
+    if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'automated-update')
+    name: Build and Release
+    permissions:
+      contents: write
+      pull-requests: read
+      id-token: write
+    uses: ./.github/workflows/ci.yml
+    with:
+      kind: "release"
+    secrets:
+      PRIVATE_KEY: ${{ secrets.PRIVATE_KEY }}

.github/workflows/auto-update-versions.yml

@@ -0,0 +1,74 @@
+name: Auto-Update Versions
+
+on:
+  schedule:
+    - cron: '0 2 * * 1' # Run every Monday at 2am UTC
+  workflow_dispatch:
+
+jobs:
+  update-versions:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate App Token
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install Dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .
+
+      - name: Run Update Commands
+        id: update
+        run: |
+          python3 -m relenv versions --update-deps
+          python3 -m relenv versions --update
+
+          if git diff --quiet relenv/python-versions.json; then
+            echo "changed=false" >> $GITHUB_OUTPUT
+          else
+            echo "changed=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Generate Changelog Entry
+        if: steps.update.outputs.changed == 'true'
+        run: |
+          mkdir -p changelog
+          ENTRY_FILE="changelog/$(date +%Y%m%d%H%M%S).improvement.rst"
+          echo "Automated version updates for Python and dependencies." > "$ENTRY_FILE"
+
+      - name: Create Pull Request
+        if: steps.update.outputs.changed == 'true'
+        id: cpr
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          commit-message: "chore: update python and dependency versions"
+          title: "Automated Version Updates"
+          body: |
+            This is an automated Pull Request to update the versions of Python and/or bundled dependencies in `python-versions.json`.
+
+            This PR will be automatically merged if CI passes, and a release will be triggered.
+          branch: "auto-update-versions"
+          base: "main"
+          delete-branch: true
+          labels: "automated-update"
+
+      - name: Enable Auto-Merge
+        if: steps.update.outputs.changed == 'true' && steps.cpr.outputs.pull-request-number != ''
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh pr merge ${{ steps.cpr.outputs.pull-request-number }} --auto --squash

tests/test_verify_build.py

@@ -396,6 +396,8 @@ def test_pip_install_salt_w_package_requirements(pipexec, pyexec, tmp_path, salt
         f"py{build_version.rsplit('.', 1)[0]}",
         f"{reqfile}.txt",
     )
+    if not os.path.exists(req):
+        req = req.replace(".txt", ".lock")
     p = subprocess.run(
         [
             str(pipexec),