.github/workflows/upgrade.yaml

name: Upgrade embedded dependencies
on:
  schedule:
    - cron: "0 10 * * *" # daily at 10:00 UTC
  workflow_dispatch:
permissions:
  contents: read
jobs:
  upgrade:
    name: Upgrade embedded pip/setuptools/wheel
    if: github.repository_owner == 'pypa'
    runs-on: ubuntu-24.04
    environment: upgrade
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Install uv
        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
      - name: Install tox
        run: uv tool install --python-preference only-managed --python 3.14 "tox>=4.32" --with tox-uv
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          ssh-key: ${{ secrets.DEPLOY_KEY }} # zizmor: ignore[artipacked]
      - name: Fetch upstream tags for versioning
        run: git fetch --force --tags https://github.com/pypa/virtualenv.git
      - name: Run upgrade
        id: upgrade
        env:
          UPGRADE_ADVISORY: "1"
        run: |
          tox run -e upgrade
          if [ -n "$(git diff --name-only)" ]; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
            echo "### Embedded dependency changes" >> "$GITHUB_STEP_SUMMARY"
            git diff --stat >> "$GITHUB_STEP_SUMMARY"
          else
            echo "changed=false" >> "$GITHUB_OUTPUT"
            echo "### All embedded dependencies are up to date" >> "$GITHUB_STEP_SUMMARY"
          fi
      - name: Check PyPI release age
        if: steps.upgrade.outputs.changed == 'true'
        id: age-check
        run: |
          cutoff=$(( $(date +%s) - 7 * 24 * 3600 ))
          too_new=false
          for whl in $(git diff --name-only -- 'src/virtualenv/seed/wheels/embed/*.whl'); do
            pkg=$(basename "$whl" | cut -d- -f1)
            version=$(basename "$whl" | cut -d- -f2)
            upload_time=$(curl -sf "https://pypi.org/pypi/${pkg}/${version}/json" | jq -r '.urls[0].upload_time_iso_8601 // empty')
            if [ -z "$upload_time" ]; then
              echo "::warning::Could not fetch release date for ${pkg}==${version}"
              continue
            fi
            release_epoch=$(date -d "$upload_time" +%s)
            if [ "$release_epoch" -gt "$cutoff" ]; then
              echo "::notice::${pkg}==${version} released less than 7 days ago (${upload_time})"
              too_new=true
            fi
          done
          if [ "$too_new" = "true" ]; then
            echo "skip=true" >> "$GITHUB_OUTPUT"
            echo "### Skipped — some packages released less than 7 days ago" >> "$GITHUB_STEP_SUMMARY"
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi
      - name: Create Pull Request
        if: steps.upgrade.outputs.changed == 'true' && steps.age-check.outputs.skip != 'true'
        id: cpr
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
        with:
          commit-message: "Upgrade embedded dependencies"
          branch: auto/upgrade-embedded-deps
          delete-branch: true
          title: "Upgrade embedded pip/setuptools/wheel"
          body: |
            Automated upgrade of embedded pip, setuptools, and wheel dependencies.

            This PR was created automatically by the [upgrade workflow](https://github.com/${{ github.repository }}/actions/workflows/upgrade.yaml).
          labels: |
            dependencies
      - name: Rename changelog with PR number
        if: steps.cpr.outputs.pull-request-number
        run: |
          pr_number="${STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER}"
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git fetch origin auto/upgrade-embedded-deps
          git checkout auto/upgrade-embedded-deps
          mv docs/changelog/u.bugfix.rst "docs/changelog/${pr_number}.bugfix.rst"
          git add docs/changelog/
          git commit -m "Rename changelog to ${pr_number}.bugfix.rst"
          git push
        env:
          STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}