From 16fee3259a600b465496ed9ace9ca9ed45f787b9 Mon Sep 17 00:00:00 2001 From: Yurii Motov Date: Tue, 30 Jun 2026 23:05:29 +0200 Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=91=B7=20Add=20GH=20workflow=20to=20b?= =?UTF-8?q?ump=20pre-commit=20hook=20versions?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/bump-pre-commit-hooks.yml | 67 +++++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 .github/workflows/bump-pre-commit-hooks.yml diff --git a/.github/workflows/bump-pre-commit-hooks.yml b/.github/workflows/bump-pre-commit-hooks.yml new file mode 100644 index 0000000..d47ad25 --- /dev/null +++ b/.github/workflows/bump-pre-commit-hooks.yml @@ -0,0 +1,67 @@ +name: Bump pre-commit hooks + +on: + schedule: + - cron: "0 12 1 * *" + workflow_dispatch: + +permissions: {} + +jobs: + bump-pre-commit-hooks: + if: github.repository_owner == 'fastapi' + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - name: Dump GitHub context + env: + GITHUB_CONTEXT: ${{ toJson(github) }} + run: echo "$GITHUB_CONTEXT" + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + token: ${{ secrets.LATEST_CHANGES }} + persist-credentials: true + - name: Set up Python + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + with: + python-version-file: ".python-version" + - name: Setup uv + uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 + with: + # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum. + # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837 + version: "0.11.18" + cache-dependency-glob: | + pyproject.toml + uv.lock + - name: Bump pre-commit hooks + run: uv run prek auto-update --freeze --cooldown-days 7 + - name: Create pull request + env: + GH_TOKEN: ${{ secrets.LATEST_CHANGES }} + BASE_BRANCH: ${{ github.event.repository.default_branch }} + run: | + set -euo pipefail + if git diff --quiet; then + echo "No pre-commit hook updates available" + exit 0 + fi + git config user.name "github-actions[bot]" + git config user.email "github-actions[bot]@users.noreply.github.com" + branch="bump-pre-commit-hooks" + git switch -C "$branch" + git add .pre-commit-config.yaml + git commit -m "⬆ Bump pre-commit hooks" + git push --force origin "$branch" + if [ -z "$(gh pr list --head "$branch" --state open --json number --jq '.[].number')" ]; then + gh pr create \ + --base "$BASE_BRANCH" \ + --head "$branch" \ + --title "⬆ Bump pre-commit hooks" \ + --body "Bump pre-commit hook versions via \`prek auto-update --freeze --cooldown-days 7\`." \ + --label internal \ + --label dependencies \ + --label pre-commit + else + echo "PR for \"$branch\" already open; branch updated in place." + fi From 576435f4a620c610987a5e6b27dd25a9b140bdb5 Mon Sep 17 00:00:00 2001 From: Yurii Motov Date: Mon, 10 Aug 2026 08:45:41 +0200 Subject: [PATCH 2/2] Use PR Submit to get token --- .github/pr-push.yml | 1 + .github/workflows/bump-pre-commit-hooks.yml | 16 +++++++++++----- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/.github/pr-push.yml b/.github/pr-push.yml index 1591365..e751a72 100644 --- a/.github/pr-push.yml +++ b/.github/pr-push.yml @@ -1,2 +1,3 @@ workflows: - .github/workflows/pre-commit.yml + - .github/workflows/bump-pre-commit-hooks.yml diff --git a/.github/workflows/bump-pre-commit-hooks.yml b/.github/workflows/bump-pre-commit-hooks.yml index d47ad25..3fb252c 100644 --- a/.github/workflows/bump-pre-commit-hooks.yml +++ b/.github/workflows/bump-pre-commit-hooks.yml @@ -12,6 +12,9 @@ jobs: if: github.repository_owner == 'fastapi' runs-on: ubuntu-latest timeout-minutes: 10 + permissions: + contents: read + id-token: write steps: - name: Dump GitHub context env: @@ -19,8 +22,7 @@ jobs: run: echo "$GITHUB_CONTEXT" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: - token: ${{ secrets.LATEST_CHANGES }} - persist-credentials: true + persist-credentials: false - name: Set up Python uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: @@ -36,9 +38,12 @@ jobs: uv.lock - name: Bump pre-commit hooks run: uv run prek auto-update --freeze --cooldown-days 7 + - name: Get PR Submit token + id: pr-submit + uses: tiangolo/pr-submit@d802fdf59bde80bc3eb8bd3259f4cbeec63de4aa # 0.0.1 - name: Create pull request env: - GH_TOKEN: ${{ secrets.LATEST_CHANGES }} + GH_TOKEN: ${{ steps.pr-submit.outputs.token }} BASE_BRANCH: ${{ github.event.repository.default_branch }} run: | set -euo pipefail @@ -46,12 +51,13 @@ jobs: echo "No pre-commit hook updates available" exit 0 fi - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" + git config user.name "pr-submit[bot]" + git config user.email "pr-submit[bot]@users.noreply.github.com" branch="bump-pre-commit-hooks" git switch -C "$branch" git add .pre-commit-config.yaml git commit -m "⬆ Bump pre-commit hooks" + gh auth setup-git git push --force origin "$branch" if [ -z "$(gh pr list --head "$branch" --state open --json number --jq '.[].number')" ]; then gh pr create \