dependencies.yml

name: Dependency Management

on:
  schedule:
    - cron: '0 0 * * 1'  
  workflow_dispatch:
  pull_request:
    paths:
      - 'pyproject.toml'
      - 'poetry.lock'

permissions:
  contents: read

jobs:
  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
      pull-requests: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        
      - name: Dependency Review
        uses: actions/dependency-review-action@v5
        with:
          fail-on-severity: critical
          fail-on-scopes: runtime
          vulnerability-check: true

  update-dependencies:
    name: Update Dependencies
    runs-on: ubuntu-latest
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.13'
          cache: pip

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libcairo2-dev libgirepository1.0-dev gir1.2-gtk-3.0

      - name: Install Poetry
        run: |
          pip install poetry
          poetry config virtualenvs.create false

      - name: Update Poetry Lock File
        run: poetry lock

      - name: Run Comprehensive Dependency Tests
        id: dependency-tests
        run: |
          # Install dependencies
          poetry install
          
          # Run the comprehensive dependency test script
          python test_dependencies.py --ci
          
          if [ $? -ne 0 ]; then
            echo "Dependency tests failed. Aborting."
            echo "dependency_tests_passed=false" >> $GITHUB_OUTPUT
            exit 1
          else
            echo "dependency_tests_passed=true" >> $GITHUB_OUTPUT
          fi

      - name: Run Project Tests
        if: steps.dependency-tests.outputs.dependency_tests_passed == 'true'
        run: |
          poetry run pytest

      - name: Check for Changes
        id: git-diff
        run: |
          if git diff --quiet poetry.lock; then
            echo "No changes detected in poetry.lock"
            echo "changed=false" >> $GITHUB_OUTPUT
          else
            echo "Changes detected in poetry.lock"
            echo "changed=true" >> $GITHUB_OUTPUT
          fi

      - name: Create PR if Changes Detected
        if: steps.git-diff.outputs.changed == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Setup git
          git config --global user.name "github-actions[bot]"
          git config --global user.email "github-actions[bot]@users.noreply.github.com"

          # Create branch
          BRANCH="deps/update-dependencies-$(date +%Y%m%d)"
          git checkout -b ${BRANCH}

          # Commit changes
          git add poetry.lock
          git commit -m "chore: update dependencies"

          # Push changes
          git push origin ${BRANCH}

          # Create PR
          gh pr create --title "chore: Update dependencies" \
                       --body "This PR updates the Poetry lock file to reflect the latest compatible versions of dependencies." \
                       --label "dependencies,automation" \
                       --base main \
                       --head ${BRANCH}