[tsvikas]

Same fix as #72, for the generated projects' deps-update.yml. Its commit had only the subject ⬆️ Update project dependencies, so a project that squash-merges with the PR's commit messages as the body (as this repo does) got an empty squash message.

Change

A new step, List the updates, for the commit message, compares the files just deps-update changed against HEAD and writes one line per bump to a step output. It covers package versions in uv.lock and hook revs in .pre-commit-config.yaml. The workflow puts that list in the commit body:

⬆️ Update project dependencies

- pygments 2.19.0 → 2.21.0
- astral-sh/ruff-pre-commit v0.16.3 → v0.16.9

It compares files because uv sync --upgrade, unlike uv lock --upgrade, prints nothing about what it bumped. The step is inline (shell: python) so generated projects don't get an extra script file. It uses tomllib, which the runner's system Python 3.12 provides.

Verification

• prek passes (actionlint, zizmor, check-github-workflows, yamllint).
• Rendered a project, committed pygments 2.19.0 and ruff-pre-commit v0.15.0, ran uv sync --upgrade and prek auto-update, then ran the step's code. It wrote this to GITHUB_OUTPUT:

updates<<EOF
- pygments 2.19.0 → 2.21.0
- astral-sh/ruff-pre-commit v0.15.0 → v0.16.9
EOF

• The hook-rev parsing strips quotes: a rev: "0.26" line (the style prek auto-update writes for validate-pyproject) parses to 0.26. Tested on that line directly; the rendered project had no quoted revs.
• Several versions of one package (from Sourcery's review): uv.lock holds a package at several versions when resolution forks by Python version or platform. The step keys each entry by its resolution-markers and lists every changed pair on one line. If a fork's markers changed, each new version is paired with the newest old version below it, and any old version left over with the oldest new one above it. Tested on a real lock (requires-python >=3.9, numpy, old lock with --exclude-newer 2025-01-01, new with 2025-09-01), where the ≥3.10 fork split in two:

  - numpy 2.2.1 → 2.2.6, 2.2.1 → 2.3.2
  

  Also checked: a same-fork bump, a merge of two forks, 2.9 → 2.10 ordering, and no change (no line).

🤖 Generated with Claude Code

https://claude.ai/code/session_01GyMoD8tx4oz1bpJ1tEL845

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="project_name/.github/workflows/deps-update.yml" line_range="41-43" />
<code_context>
+              return subprocess.run(cmd, capture_output=True, text=True, check=True).stdout
+
+          def packages(text):
+              lock = tomllib.loads(text).get("package", [])
+              return {p["name"]: p["version"] for p in lock if "version" in p}
+
+          def hook_revs(text):
+              pairs = re.findall(r"- repo: https://github.com/(\S+)\n\s+rev: (\S+)", text)
</code_context>
<issue_to_address>
**issue (bug_risk):** `packages` collapses all `[[package]]` entries with the same name into one dictionary value. uv.lock can contain multiple versions of a package when different dependencies require incompatible versions, so the selected value depends on entry order and the generated commit message reports an arbitrary version change or omits a real bump.

**Triggers:** When the lock file contains more than one version of the same package before or after the upgrade.

**Suggested fix:** Track package entries by `(name, version)` or otherwise compare all versions for each package instead of reducing them to a single name-keyed value.
</issue_to_address>

Sourcery assessment

Approval pending. 1 finding to address first.

Blocking findings: project_name/.github/workflows/deps-update.yml:43

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[sourcery-ai]

Sourcery assessment

Approved.