Repository navigation
Upgrade uv.lock weekly in a workflow, not with Dependabot - #574
Conversation
Dependabot's uv updater always raises the floor in pyproject.toml to the version it upgrades to, and it ignores versioning-strategy. pydocket is a library, so its floors should stay as low as it supports, and only uv.lock should move. Raising floors also breaks the weekly group: ipython, zensical, mkdocstrings, and starlette now need Python 3.11, and the workspace supports 3.10, so the 2026-10-21 run failed and opened no PR. #568 is another raised floor. The new Lock workflow runs uv lock --upgrade every Monday and opens or updates one PR. uv keeps older versions for Python 3.10 where it must, so the upgrade resolves. The workflow opens the PR with a GitHub App token, because a PR opened with GITHUB_TOKEN does not start CI. Dependabot keeps the cargo and GitHub Actions updates, and its security updates for uv.lock stay on. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PrT3ujS7JeG2N7JMdYngA9
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 41baa04585
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| echo "This upgrades every package in uv.lock to its latest version that the floors in pyproject.toml allow. The floors do not change." | ||
| echo | ||
| echo '```' | ||
| grep -E '^(Updated|Added|Removed) ' upgrade.log |
There was a problem hiding this comment.
When uv changes uv.lock without adding, removing, or changing a package version—for example, during lock-format or artifact-metadata normalization—upgrade.log need not contain any line matching this expression even though the earlier diff check found a valid lockfile change. grep returns status 1 when it selects no lines (GNU grep documentation), and GitHub runs an unspecified Linux shell with bash -e (workflow syntax), so the step exits here before committing or opening the PR. Make the summary extraction non-fatal and allow an empty or fallback summary.
Useful? React with 👍 / 👎.
Dependabot's uv updater always raises the floor in pyproject.toml to the version it upgrades to, and it ignores versioning-strategy. pydocket is a library, so its floors should stay as low as it supports, and only uv.lock should move. Raising floors also breaks the weekly group: ipython, zensical, mkdocstrings, and starlette now need Python 3.11, and the workspace supports 3.10, so the 2026-10-21 run failed and opened no PR. #568 is another raised floor.
The new Lock workflow runs uv lock --upgrade every Monday and opens or updates one PR. uv keeps older versions for Python 3.10 where it must, so the upgrade resolves. The workflow opens the PR with a GitHub App token, because a PR opened with GITHUB_TOKEN does not start CI. Dependabot keeps the cargo and GitHub Actions updates, and its security updates for uv.lock stay on.
🤖 Generated with Claude Code
https://claude.ai/code/session_01PrT3ujS7JeG2N7JMdYngA9