Automate dependency updates with a scheduled Action

まず、リポジトリに既存する GitHub Actions の workflow と依存関係マニフェストを確認し、続いてそれらの権限とテストのトリガーを、提案されているスケジュール済み workflow と比較します。月次の workflow が指定された non-breaking 戦略と 14 日間の release age を使用し、更新用の pull request を作成し、必要な PAT 設定が maintainer によって確認されれば完了です。

🚀 The feature, motivation and pitch

Hi, thanks for creating and maintaining this package. I use it in some of my own projects and wanted to help make sure it stays secure and well maintained with the least effort from maintainers.

Looking through the commit history, dependency bumps look like they're done manually right now, but I've recently created a new GitHub Action called Update Dependencies that might help here: https://github.com/marketplace/actions/update-dependencies

It scans your package manager(s), opens a PR with version bumps, and labels each change as breaking or non-breaking (Depending on which strategy we use).

Suggested setup for this repo:

• Run it monthly, non-breaking updates only, so not much manual review is needed.
• Set min-release-age-days to 14 (default is 3, similar to Github's Dependabot). That gives the community about two weeks to catch bugs or security issues in a new release before it lands here.
• If you already run tests on every PR (which it seems you do), no extra config needed; your CI just checks the update PR like any other PR.

One thing worth noting: the GitHub token should be a PAT rather than the default token, so your CI actually triggers on the PR it opens. That'd need an admin to create and maintain.

Example workflow:

name: Update Dependencies

on:
  schedule:
    - cron: '0 2 1 * *' # monthly, 1st of month at 02:00 UTC
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  update:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: yanovian/update-dependencies-action@v1
        with:
          update-strategy: non-breaking
          min-release-age-days: 14
          create-pull-request: true
          github-token: ${{ secrets.PAT_TOKEN }}

What do you think? Happy to help set it up if useful.

Alternatives

Manual update or "custom scripts" but none of them actually check with the list of CVEs, and also it is not easy to check the update time for every single package.

Additional context

No response

RFC (Optional)

No response