update_dependencies.yml

name: Update dependencies

# smoelius: 'Dependabot only makes Rust security updates if "Cargo.lock" exists'
# https://github.com/dependabot/dependabot-core/issues/2011

# So, every Friday at 3:00 UTC (Thursday at 22:00 EST), run `cargo upgrade` and create a PR.

on:
  schedule:
    - cron: "0 3 * * 5"
  workflow_dispatch:

jobs:
  update:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
        with:
          # https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#triggering-further-workflow-runs
          # https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#push-using-ssh-deploy-keys
          ssh-key: ${{ secrets.SSH_KEY }}

      - name: Install cargo-edit
        run: cargo install cargo-edit

      - name: Update dependencies
        run: |
          cargo update
          cargo upgrade

      - name: Create pull request
        uses: peter-evans/create-pull-request@v7
        with:
          title: Update dependencies
          branch: update-dependencies
          branch-suffix: random
          commit-message: Update dependencies
          token: ${{ secrets.REPO_TOKEN }}