cargo-update.yml

---
name: Update Deps

on:
  workflow_dispatch:
  # Run every Monday at 0530 UTC
  schedule:
    - cron: '30 5 * * 1'

jobs:
  cargo-update:
    name: Update dependencies
    runs-on: ubuntu-latest
    env:
      UPDATE_BRANCH_NAME: auto-cargo-update
    steps:
      - name: Checkout the repo
        uses: actions/checkout@v6

      - name: Cargo update
        run: cargo update

      - name: Commit changes
        id: commit
        # There may not be any updates to commit/push
        continue-on-error: true
        run: |
          git config user.name 'phylum-bot'
          git config user.email '69485888+phylum-bot@users.noreply.github.com'
          git commit -a -m "Bump dependencies"
          git push --force origin HEAD:${{ env.UPDATE_BRANCH_NAME }}

      - name: Create Pull Request
        id: pr
        if: ${{ steps.commit.outcome == 'success' }}
        # The PR may already exist (e.g., created in previous week and not merged yet) so we
        # allow it here and check in the next step so workflow failures will be extraordinary
        continue-on-error: true
        uses: actions/github-script@v8
        with:
          github-token: ${{ secrets.GH_RELEASE_PAT }}
          script: |
            const response = await github.rest.pulls.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              head: "${{ env.UPDATE_BRANCH_NAME }}",
              base: context.ref,
              title: "Bump dependencies",
              body: "Bump dependencies for all SemVer-compatible updates.",
            });
            console.log(response);

      - name: Verify PR exists
        if: ${{ steps.pr.outcome == 'failue' }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh pr view ${{ env.UPDATE_BRANCH_NAME }}