From 63081eadc1eb8d3e931327998fff7153a3a586c5 Mon Sep 17 00:00:00 2001
From: Giovanni Condello <condellog@gmail.com>
Date: Tue, 20 Oct 2026 00:10:36 +0200
Subject: [PATCH 1/2] ci: open a monthly PR with a poetry update

---
 .github/workflows/update_lock.yml | 44 +++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 .github/workflows/update_lock.yml

diff --git a/.github/workflows/update_lock.yml b/.github/workflows/update_lock.yml
new file mode 100644
index 0000000..f7abb7d
--- /dev/null
+++ b/.github/workflows/update_lock.yml
@@ -0,0 +1,44 @@
+name: Update lock file
+
+on:
+  schedule:
+    - cron: '0 6 1 * *'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update-lock:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          ref: develop
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Install Poetry
+        uses: snok/install-poetry@v1
+
+      - name: Update lock file
+        run: poetry update --lock --no-interaction
+
+      - name: Open pull request
+        uses: peter-evans/create-pull-request@v7
+        with:
+          # A PAT lets CI run on the PR; PRs opened with GITHUB_TOKEN do not trigger workflows
+          token: ${{ secrets.UPDATE_LOCK_TOKEN || secrets.GITHUB_TOKEN }}
+          base: develop
+          branch: chore/update-lock
+          commit-message: "chore: update lock file"
+          title: "chore: update lock file"
+          body: "Monthly `poetry update`. Review the lock file diff and wait for CI."
+          add-paths: poetry.lock
+          delete-branch: true

From 137c29ce9d20d74cd06dcc64260e745bad1a9ebb Mon Sep 17 00:00:00 2001
From: Giovanni Condello <condellog@gmail.com>
Date: Tue, 20 Oct 2026 00:11:41 +0200
Subject: [PATCH 2/2] ci: validate the update in the workflow instead of using
 a PAT

---
 .github/workflows/update_lock.yml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/update_lock.yml b/.github/workflows/update_lock.yml
index f7abb7d..37d3b46 100644
--- a/.github/workflows/update_lock.yml
+++ b/.github/workflows/update_lock.yml
@@ -30,11 +30,19 @@ jobs:
       - name: Update lock file
         run: poetry update --lock --no-interaction
 
+      # PRs opened with GITHUB_TOKEN do not trigger CI, so validate here before opening one
+      - name: Install dependencies
+        run: poetry install --no-root --no-interaction
+
+      - name: Type check
+        run: poetry run mypy
+
+      - name: Run tests
+        run: poetry run pytest tests
+
       - name: Open pull request
         uses: peter-evans/create-pull-request@v7
         with:
-          # A PAT lets CI run on the PR; PRs opened with GITHUB_TOKEN do not trigger workflows
-          token: ${{ secrets.UPDATE_LOCK_TOKEN || secrets.GITHUB_TOKEN }}
           base: develop
           branch: chore/update-lock
           commit-message: "chore: update lock file"