ci: add automated uv lock --upgrade workflow (#5307)

.github/workflows/ci.yml

@@ -22,6 +22,7 @@ jobs:
     outputs:
       python: ${{ steps.filter.outputs.python }}
       sdk-js: ${{ steps.filter.outputs.sdk-js }}
+      deps: ${{ steps.filter.outputs.deps }}
     steps:
       - uses: actions/checkout@v4
       - uses: dorny/paths-filter@v3
@@ -38,6 +39,9 @@ jobs:
               - 'libs/prebuilt/**'
             sdk-js:
               - 'libs/sdk-js/**'
+            deps:
+              - '**/pyproject.toml'
+              - '**/uv.lock'
 
   lint:
     needs: changes
@@ -55,7 +59,7 @@ jobs:
 
             "libs/prebuilt",
           ]
-    if: needs.changes.outputs.python == 'true'
+    if: needs.changes.outputs.python == 'true' || needs.changes.outputs.deps == 'true'
     uses: ./.github/workflows/_lint.yml
     with:
       working-directory: ${{ matrix.working-directory }}
@@ -74,7 +78,7 @@ jobs:
             "libs/checkpoint-postgres",
             "libs/prebuilt",
           ]
-    if: needs.changes.outputs.python == 'true'
+    if: needs.changes.outputs.python == 'true' || needs.changes.outputs.deps == 'true'
     uses: ./.github/workflows/_test.yml
     with:
       working-directory: ${{ matrix.working-directory }}
@@ -83,7 +87,7 @@ jobs:
   # NOTE: we're testing langgraph separately because it requires a different matrix
   test-langgraph:
     needs: changes
-    if: needs.changes.outputs.python == 'true'
+    if: needs.changes.outputs.python == 'true' || needs.changes.outputs.deps == 'true'
     name: "cd libs/langgraph"
     uses: ./.github/workflows/_test_langgraph.yml
     secrets: inherit
@@ -140,7 +144,7 @@ jobs:
 
   integration-test:
     needs: changes
-    if: needs.changes.outputs.python == 'true'
+    if: needs.changes.outputs.python == 'true' || needs.changes.outputs.deps == 'true'
     name: CLI integration test
     uses: ./.github/workflows/_integration_test.yml
     secrets: inherit

.github/workflows/uv_lock_ugprade.yml

@@ -0,0 +1,45 @@
+name: UV Lock Upgrade
+
+on:
+  schedule:
+    # run at midnight every Sunday
+    - cron: '0 0 * * 0'
+  # allow manual triggering
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  upgrade-dependencies:
+    runs-on: ubuntu-latest
+    
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          # use minimum supported Python version
+          python-version: "3.9"
+          enable-cache: true
+          cache-suffix: "uv-lock-upgrade"
+          
+      - name: Run uv lock --upgrade in all Python packages
+        run: make lock-upgrade
+          
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: "chore: upgrade dependencies with `uv lock --upgrade`"
+          title: "chore: upgrade dependencies with `uv lock --upgrade`"
+          body: |
+            This PR updates the dependencies in all Python packages using `uv lock --upgrade`.
+            
+            This is an automated PR created by the UV Lock Upgrade workflow.
+          branch: deps/uv-lock-upgrade
+          delete-branch: true
+          labels: |
+            dependencies

Makefile

@@ -47,6 +47,16 @@ lock:
 		fi; \
 	done
 
+# Lock all projects and upgrade dependencies
+.PHONY: lock-upgrade
+lock-upgrade:
+	@for dir in $(LIBS_DIRS); do \
+		if [ -f $$dir/Makefile ]; then \
+			echo "Running lock-upgrade in $$dir"; \
+			(cd $$dir && uv lock --upgrade); \
+		fi; \
+	done
+
 # Test all projects
 .PHONY: test
 test: