Outdated dependencies can cause a variety of issues in a project. These issues include:
By automating the update process, you ensure that your dependencies stay current with minimal manual effort, reducing the risk of issues caused by outdated packages.
GitHub Actions is a powerful automation tool that allows you to set up workflows to automate various tasks in your development pipeline, including package updates. A workflow is essentially a YAML file that defines the steps for a series of actions to be executed in response to a trigger, such as a push to a repository or a scheduled time.
With GitHub Actions, you can automate the process of updating packages by defining a custom workflow that installs the dotnet-outdated tool, checks for outdated packages, updates them, and creates a pull request with the changes. This allows for hands-off dependency management, saving developers time and reducing the risk of human error.
on:
schedule:
- cron: "0 0 25 * *"
workflow_dispatch:
inputs:
version_type:
description: 'Version Type (Major / Minor)'
default: 'Major'
required: true
target_branch:
description: 'Target branch'
default: 'master'
required: true
package_list:
description: 'Comma-separated list of specific packages to update'
default: 'Umbraco.Cms'
required: true
The workflow is triggered in two ways:
Scheduled Execution: The schedule event is configured with a cron expression "0 0 25 * *", which runs the workflow on the 25th day of every month at midnight. This ensures that the packages are updated monthly without requiring manual input.
Manual Trigger: The workflow_dispatch event allows you to manually trigger the workflow. When doing so, you can specify:
The workflow defines a single job: auto-update, which runs on the latest version of Ubuntu. Let’s go through the steps involved in this job.
jobs:
auto-update:
runs-on: ubuntu-latest
- name: Checkout the current branch
uses: actions/checkout@v3
The first step checks out the current branch of the repository using the actions/checkout action. This step is crucial as it ensures the workflow is operating on the latest version of the code.
- name: Install dotnet outdated
run: |
sudo apt-get install -y dotnet-sdk-8.0
dotnet tool install --global dotnet-outdated-tool
In this step, the workflow installs the .NET SDK and the dotnet-outdated-tool. This tool is used to check for outdated NuGet packages in your project. By using this tool, we can easily identify which packages need updating.
dotnet-outdated is a command-line tool for checking and updating outdated NuGet packages in .NET projects. It simplifies the process of identifying which packages need updating, providing an easy way to keep your project dependencies fresh.
Key features of dotnet-outdated include:
By using dotnet-outdated in this workflow, you ensure that only the necessary packages are updated, reducing the risk of introducing breaking changes.
- name: Generate timestamp
id: timestamp
run: echo "TIMESTAMP=$(date +'%Y%m%d%H%M%S')" >> $GITHUB_ENV
Here, a timestamp is generated and stored in the GitHub environment variables. This timestamp will be used to create a unique branch for the pull request that will be created later.
- name: Update packages (conditional based on user input)
run: |
echo "Updating specific packages: ${{ github.event.inputs.package_list }}"
for package in $(echo "${{ github.event.inputs.package_list }}" | tr "," "\n"); do
dotnet outdated -u -vl ${{ github.event.inputs.version_type }} --include $package
done
This step is the core of the workflow. It updates the specified packages based on the user’s input:
- name: Create a PR to the main branch for packages ${{ github.event.inputs.package_list }}
uses: peter-evans/create-pull-request@v7
with:
token: ${{ secrets.GITHUB_TOKEN }}
branch: auto-update-${{ env.TIMESTAMP }}
commit-message: "Update to latest ${{ github.event.inputs.version_type }} packages ${{ github.event.inputs.package_list }}"
title: "Auto-update packages to ${{ github.event.inputs.version_type }} versions"
body: "This PR updates the following packages to the latest ${{ github.event.inputs.version_type }} versions. ${{ github.event.inputs.package_list }}"
The final step in the workflow creates a pull request to update the target branch with the latest package versions. The pull request:
This step uses the peter-evans/create-pull-request action to automate the creation of the PR, making it easy to review the changes before merging.
The peter-evans/create-pull-request GitHub Action simplifies the process of creating pull requests from within workflows. It is widely used for automating PR creation in scenarios like dependency updates, documentation changes, or automatically generated content.
Features of this action:
By using create-pull-request, you can automate the process of updating packages, create a dedicated branch, and ensure that updates are reviewed before being merged into the main codebase.
By automating package updates, you can:
Additionally, the flexibility to choose between major and minor version updates allows for a controlled update process, minimizing the risk of introducing breaking changes.
Here’s an full working example YAML file for automating package updates using GitHub Actions and Dotnet Outdated:
name: Auto Update Packages
on:
schedule:
- cron: "0 0 25 * *"
workflow_dispatch:
inputs:
version_type:
description: 'Version Type (Major / Minor)'
default: 'Major'
required: true
package_list:
description: 'Comma-separated list of specific packages to update'
default: 'Umbraco.Cms'
required: true
jobs:
auto-update:
runs-on: ubuntu-latest
steps:
- name: Checkout the current branch
uses: actions/checkout@v3
- name: Install dotnet outdated
run: |
sudo apt-get install -y dotnet-sdk-8.0
dotnet tool install --global dotnet-outdated-tool
- name: Generate timestamp
id: timestamp
run: echo "TIMESTAMP=$(date +'%Y%m%d%H%M%S')" >> $GITHUB_ENV
- name: Update packages (conditional based on user input)
run: |
echo "Updating specific packages: ${{ github.event.inputs.package_list }}"
for package in $(echo "${{ github.event.inputs.package_list }}" | tr "," "\n"); do
dotnet outdated -u -vl ${{ github.event.inputs.version_type }} --include $package
done
- name: Create a PR to the main branch for packages ${{ github.event.inputs.package_list }}
uses: peter-evans/create-pull-request@v7
with:
token: ${{ secrets.GITHUB_TOKEN }}
branch: auto-update-${{ env.TIMESTAMP }}
commit-message: "Update to latest ${{ github.event.inputs.version_type }} packages ${{ github.event.inputs.package_list }}"
title: "Auto-update packages to ${{ github.event.inputs.version_type }} versions"
body: "This PR updates the following packages to the latest ${{ github.event.inputs.version_type }} versions. ${{ github.event.inputs.package_list }}"