neiam /gitgud

Git Gud

dependency-updates: daily, not weekly

dba03dd · Gabriel Morell · 2026-10-23 05:32

8 files +7 -6

Message

{commit_body(@commit)}

modified .forgejo/workflows/dependency-updates.yml

+4 −3

@@ -7,11 +7,12 @@ name: dependency-updates

7	7	# are opened by the forge's CI account (gg-security) with this job's own
8	8	# token; their CI (audit.yml among it) is what shows the fixes landed.
9	9	#
10		−# Weekly, and by hand from the Actions page (`gg ci dispatch
11		−# dependency-updates`).
	10	+# Daily, an hour before audit.yml, so a fix released overnight is a pull
	11	+# request by morning; and by hand from the Actions page (`gg ci dispatch
	12	+# dependency-updates`). A day with nothing new to fix pushes nothing.
12	13	on:
13	14	schedule:
14		− - cron: "23 5 * * 1"
	15	+ - cron: "23 5 * * *"
15	16	workflow_dispatch:
16	17
17	18	permissions:

modified docs/plans/dependency-security.md

+2 −2

@@ -141,7 +141,7 @@ starter for any repository here and used first on the forge itself.

141	141	```yaml
142	142	name: dependency-updates
143	143	on:
144		− schedule: [{ cron: "23 5 * * 1" }] # weekly
	144	+ schedule: [{ cron: "23 5 * * *" }] # daily
145	145	workflow_dispatch:
146	146	permissions:
147	147	contents: write # push the branch

@@ -362,7 +362,7 @@ then `./gradlew dependencies --write-locks`) commits a

362	362	3. B — `scripts/dependency-update` and the workflow, on this
363	363	repository; then documented as a starter on `/run-your-own`.
364	364	Built (`scripts/dependency-update`, Python 3, standard library;
365		− `.forgejo/workflows/dependency-updates.yml`, weekly and by hand).
	365	+ `.forgejo/workflows/dependency-updates.yml`, daily and by hand).
366	366	Hex and crates.io; Cargo goes to the lowest fixed version
367	367	(`--precise`), Hex as far as `mix.exs` allows past it (mix has no
368	368	`--precise`), and the pull request lists what came along with it.

modified scripts/dependency-update

+1 −1

@@ -377,7 +377,7 @@ def main():

377	377	run(["git", "commit", "--quiet", "-m", title, "-m", body])
378	378
379	379	# Push only when the result differs from what the branch has — the
380		− # bumps, or the base it sits on — so an unchanged week doesn't
	380	+ # bumps, or the base it sits on — so an unchanged day doesn't
381	381	# re-run the pull request's CI, but a moved base does move it.
382	382	remote = run(["git", "rev-parse", "--verify", "--quiet", f"refs/remotes/origin/{branch}"], check=False)
383	383	same = remote.returncode == 0 and run(

Parents: 00f4614