@@ -8,25 +8,25 @@ Automate CPython patch updates across every Python version reference in your rep
88
99DevOps, SRE, platform, and Python maintainers need consistent runtimes without manual patching. This action:
1010
11- * Finds pinned CPython versions everywhere you declare them.
12- * Resolves the latest stable patch and opens an evergreen PR.
13- * Minimizes diffs and noise. Adds auditability and easy rollbacks.
14- * Plays well with Renovate and Dependabot.
11+ - Finds pinned CPython versions everywhere you declare them.
12+ - Resolves the latest stable patch and opens an evergreen PR.
13+ - Minimizes diffs and noise. Adds auditability and easy rollbacks.
14+ - Plays well with Renovate and Dependabot.
1515
1616Keywords: GitHub Action, CPython patch updates, Python version management, automated dependency updates, CI/CD automation, security maintenance.
1717
1818## Feature overview
1919
20- * Cross-file detection: Dockerfiles, GitHub workflows, ` .python-version ` , ` .tool-versions ` , ` runtime.txt ` , ` tox.ini ` , ` pyproject.toml ` , ` Pipfile ` , Conda ` environment.yml ` , and more.
21- * Smart discovery: Pulls CPython tags from GitHub with python.org fallback. Checks GitHub runner availability. Pre-release guard on by default.
22- * Minimal rewrites: Targeted replacements that preserve image suffixes like ` -slim ` and ` -alpine ` . Dry-run summary before writes.
23- * Idempotent: Skips if already on latest and sets ` skipped_reason=already_latest ` .
24- * Branch and PR automation: Predictable branch name. Updates an existing PR or opens a new one via Octokit.
25- * External PR support: Emits outputs for ` peter-evans/create-pull-request ` when preferred.
26- * Automerge ready: Hook for label or merge after checks pass.
27- * Security keyword gate: Only upgrade if release notes include keywords such as ` CVE ` or ` security ` .
28- * Offline snapshots: Run without network using provided tag, runner, and release notes snapshots.
29- * CI matrix fan-out: Output a change matrix to scope targeted jobs.
20+ - Cross-file detection: Dockerfiles, GitHub workflows, ` .python-version ` , ` .tool-versions ` , ` runtime.txt ` , ` tox.ini ` , ` pyproject.toml ` , ` Pipfile ` , Conda ` environment.yml ` , and more.
21+ - Smart discovery: Pulls CPython tags from GitHub with python.org fallback. Checks GitHub runner availability. Pre-release guard on by default.
22+ - Minimal rewrites: Targeted replacements that preserve image suffixes like ` -slim ` and ` -alpine ` . Dry-run summary before writes.
23+ - Idempotent: Skips if already on latest and sets ` skipped_reason=already_latest ` .
24+ - Branch and PR automation: Predictable branch name. Updates an existing PR or opens a new one via Octokit.
25+ - External PR support: Emits outputs for ` peter-evans/create-pull-request ` when preferred.
26+ - Automerge ready: Hook for label or merge after checks pass.
27+ - Security keyword gate: Only upgrade if release notes include keywords such as ` CVE ` or ` security ` .
28+ - Offline snapshots: Run without network using provided tag, runner, and release notes snapshots.
29+ - CI matrix fan-out: Output a change matrix to scope targeted jobs.
3030
3131## Quick start
3232
@@ -49,7 +49,7 @@ Keywords: GitHub Action, CPython patch updates, Python version management, autom
4949 steps :
5050 - uses : actions/checkout@v4
5151 - name : Bump CPython patch versions
52- uses : casperkristiansson/python-version-patch-pr@v0
52+ uses : casperkristiansson/python-version-patch-pr@v1
5353 with :
5454 track : ' 3.12'
5555 automerge : false
@@ -76,10 +76,10 @@ Keywords: GitHub Action, CPython patch updates, Python version management, autom
7676| ------------------------ | -------- | --------------------- | --------------------------------------------------------------------------------------- |
7777| `track` | false | `3.13` | CPython minor series to monitor (for example `3.12`). |
7878| `include_prerelease` | false | `false` | Allow `rc`, `a`, or `b` releases when determining the latest patch. |
79- | `paths` | false | * (see default globs)* | Newline-separated glob patterns to scan. |
79+ | `paths` | false | _ (see default globs)_ | Newline-separated glob patterns to scan. |
8080| `automerge` | false | `false` | Label or merge the bump PR once checks pass. |
8181| `dry_run` | false | `false` | Skip file writes and emit a change summary instead. |
82- | `security_keywords` | false | * (empty)* | Require at least one keyword to appear in release notes before upgrading. |
82+ | `security_keywords` | false | _ (empty)_ | Require at least one keyword to appear in release notes before upgrading. |
8383| `use_external_pr_action` | false | `false` | Emit outputs for `peter-evans/create-pull-request` instead of using Octokit internally. |
8484
8585**Default globs**
@@ -108,7 +108,7 @@ Dockerfile
108108
109109```yaml
110110- name: CPython bump preview
111- uses: casperkristiansson/python-version-patch-pr@v0
111+ uses: casperkristiansson/python-version-patch-pr@v1
112112 with:
113113 track: '3.11'
114114 dry_run: true
@@ -141,7 +141,7 @@ When set, the action fetches GitHub release notes for the resolved tag (or uses
141141` ` ` yaml
142142- name: Bump CPython patch versions
143143 id: bump_python
144- uses: casperkristiansson/python-version-patch-pr@v0
144+ uses: casperkristiansson/python-version-patch-pr@v1
145145 with:
146146 use_external_pr_action: true
147147
@@ -169,7 +169,7 @@ jobs:
169169 steps:
170170 - uses: actions/checkout@v4
171171 - id: bump
172- uses: casperkristiansson/python-version-patch-pr@v0
172+ uses: casperkristiansson/python-version-patch-pr@v1
173173
174174 targeted-tests:
175175 needs: bump-python
@@ -186,28 +186,28 @@ jobs:
186186
187187Avoid competing PRs while keeping other automated dependency updates.
188188
189- * `examples/coexistence/renovate.json` disables patch updates for the `python` base image and matching regex managers.
190- * `examples/coexistence/dependabot.yml` ignores semver patch updates for the `python` Docker image.
189+ - ` examples/coexistence/renovate.json` disables patch updates for the `python` base image and matching regex managers.
190+ - ` examples/coexistence/dependabot.yml` ignores semver patch updates for the `python` Docker image.
191191
192192Both samples are validated by tests. Copy and adjust schedules or rules as needed.
193193
194194# ## Offline mode
195195
196196Run without network by providing snapshots and setting `NO_NETWORK_FALLBACK=true`.
197197
198- * `CPYTHON_TAGS_SNAPSHOT`: JSON array of CPython tag objects.
199- * `PYTHON_ORG_HTML_SNAPSHOT`: Raw HTML or path to a saved python.org releases page.
200- * `RUNNER_MANIFEST_SNAPSHOT`: JSON manifest compatible with `actions/python-versions`.
201- * `RELEASE_NOTES_SNAPSHOT`: Map tags or versions to release note strings.
198+ - `CPYTHON_TAGS_SNAPSHOT` : JSON array of CPython tag objects.
199+ - `PYTHON_ORG_HTML_SNAPSHOT` : Raw HTML or path to a saved python.org releases page.
200+ - `RUNNER_MANIFEST_SNAPSHOT` : JSON manifest compatible with `actions/python-versions`.
201+ - `RELEASE_NOTES_SNAPSHOT` : Map tags or versions to release note strings.
202202
203203Each accepts inline data or a file path. Missing snapshots fail fast with a clear message.
204204
205205# # Example consumer repositories
206206
207207See templates in [`examples/`](examples) :
208208
209- * [`examples/minimal`](examples/minimal): single-job workflow scheduled weekly.
210- * [`examples/guarded`](examples/guarded): dry-run preview with release-note gating and concurrency controls.
209+ - [`examples/minimal`](examples/minimal) : single-job workflow scheduled weekly.
210+ - [`examples/guarded`](examples/guarded) : dry-run preview with release-note gating and concurrency controls.
211211
212212# # Permissions
213213
@@ -235,8 +235,8 @@ See `CHANGELOG.md`.
235235
236236# # Roadmap and contributions
237237
238- * Read `CONTRIBUTING.md` for local setup and standards.
239- * Open issues or PRs for edge cases and roadmap items.
238+ - Read `CONTRIBUTING.md` for local setup and standards.
239+ - Open issues or PRs for edge cases and roadmap items.
240240
241241# # Security
242242
0 commit comments