mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
Pinning the collections froze them, and nothing thaws a pin: dependabot reads pyproject.toml, the docker updater reads image tags, and neither sees a version inside requirements/. The new job resolves upstream releases with git ls-remote --tags and opens a PR the same way the pip, image and repository-ref updaters do. Both requirement files are bumped together, because the git fallback has to install what the Galaxy file declares; moving only one would break that. A collection whose two files disagree, or whose version is not a semver, is left alone -- that covers the branch ref and the commit pin, which state an intent a bumper must not guess. The job calls pr.sh rather than role_prs.sh: the latter splits per sub-directory and would open no PR at all for flat paths like requirements/*.yml. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>