PDM (the Python Development Master) based approach to automatically update your dependencies in pdm.lock

.gitlab-ci.yml

# Instructions for gitlab are yet to come.

auto-update-using-pdm.yml

# Unlicense (see LICENSE file below)

# Describes an automatic update with PDM using gitlab actions

name: Automatic update released versions
on:
  schedule:
    - cron:  '0 18 * * *' # Each day at 6 pm - set according to your own needs. See https://crontab.guru for explanations, if needed
  workflow_dispatch: # Do nothing at all
jobs:
  auto-update:
    name: Perform automatic update
    runs-on: ubuntu-latest
    steps:
      # In order to create a pull request, a personalized TOKEN is needed.
      - 
        name: Ensure PAT is set
        env:
          CI_CD_ACTION_AUTO_UPDATE_TOKEN: ${{ secrets.AUTO_UPDATE_TOKEN }}
        run: |
          if [ -z "${CI_CD_ACTION_AUTO_UPDATE_TOKEN}" ];
          then
            echo "Set repository secret AUTO_UPDATE_TOKEN to a non-empty value." >&2
            exit 1
          fi
      # Install python the machine
      - 
        name: Set up Python
        uses: actions/setup-python@v2
        with:
          python-version: '3.9' # Set according to your needs 
      # Checkout the repository
      - 
        name: Checkout this repository
        uses: actions/checkout@v2
      # Install PDM
      - 
        uses: pdm-project/setup-pdm@main
        name: Setup PDM
        with:
          python-version: 3.9  # Version range or exact version of a Python version to use, the same as actions/setup-python
          architecture: x64    # The target architecture (x86, x64) of the Python interpreter. the same as actions/setup-python
          version: 1.12.7      # The version of PDM to install. Leave it as empty to use the latest version from PyPI
          prerelease: false    # Allow prerelease versions to be installed
          enable-pep582: true  # Enable PEP 582 package loading globally
      # Install dependencies in the first place
      - 
        name: Install dependencies from pdm.lock
        run: pdm install       
      # Update Packages
      - 
        name: Update dependencies to latest versions
        id: pdm_update
        run: |
          message=$(pdm update) # If you only want to check if there newer versions, use PDM outdated
          # Preserve whitespace characters 
          message="${message//'%'/'%25'}" 
          message="${message//$'\n'/'%0A'}"
          message="${message//$'\r'/'%0D'}"
          echo ::set-output name=message::${message} 
      # Check if lock file has been modified
      - 
        name: Get all files changed
        id: changed_files
        run: |
          modified_version_files=$(git status --porcelain --untracked-files=no pdm.lock | sed 's/^ M //g')
          echo ::set-output name=modified_files::${modified_version_files}
          if [ -n "${modified_version_files}" ];
          then
            echo ::set-output name=any_modified::true
          else
            echo ::set-output name=any_modified::false
          fi
       # Create a new pull request, if changed files are present
       - 
        name: Commit and create Pull request
        id: create-pr
        uses: peter-evans/create-pull-request@v3 # Refer to marketplace for documentation
        if: ${{ steps.changed_files.outputs.any_modified == 'true' }}
        with:
          token: ${{ secrets.AUTO_UPDATE_TOKEN }}
          add-paths: |
            pdm.lock
          commit-message: "dep: Updating dependent packages" # I prefer using dep: as prefix for dependency updates
          committer: ${{ github.repository_owner }} <${{ github.repository_owner }}@users.noreply.github.com>
          author: ${{ github.repository_owner }} <${{ github.repository_owner }}@users.noreply.github.com>
          signoff: false
          branch: auto-update/dependencies # The branch to use
          branch-suffix: timestamp
          delete-branch: true
          title: "Automatic update of dependent packages"
          body: ${{ steps.pdm_update.outputs.message }}
          assignees: ${{ github.repository_owner }}
      # Automatically close the pull request
      - 
        name: Close Pull request automatically, if it succeeds
        uses: peter-evans/enable-pull-request-automerge@v1 # Refer to marketplace for documentation
        if: ${{ steps.changed_files.outputs.any_modified == 'true' }}
        with:
          token: ${{ secrets.AUTO_UPDATE_TOKEN }}
          pull-request-number: ${{ steps.create-pr.outputs.pull-request-number }}
          merge-method: rebase # No need to create a new commit or a squash merge here
       # You can use a slack / matrix / gitter / gotify or whatever notification here to inform you

LICENSE

This is free and unencumbered software released into the public domain.

Anyone is free to copy, modify, publish, use, compile, sell, or
distribute this software, either in source code form or as a compiled
binary, for any purpose, commercial or non-commercial, and by any
means.

In jurisdictions that recognize copyright laws, the author or authors
of this software dedicate any and all copyright interest in the
software to the public domain. We make this dedication for the benefit
of the public at large and to the detriment of our heirs and
successors. We intend this dedication to be an overt act of
relinquishment in perpetuity of all present and future rights to this
software under copyright law.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
OTHER DEALINGS IN THE SOFTWARE.

For more information, please refer to <http://unlicense.org/>