Github Actions

Reusable Github Actions workflows and composite actions for Python projects.

Workflows

pytest-uv

Runs tests with pytest using uv.

pre-commit-uv

Runs pre-commit hooks using uv and pre-commit-uv.

prek

Runs prek hooks using the prek-action. prek is a fast, Rust-based drop-in replacement for pre-commit.

security-updates (reusable workflow)

Automatically upgrades vulnerable dependencies (direct and transitive) in uv.lock. Complements tools like Renovate, which can only bump direct dependencies declared in pyproject.toml. This workflow reads GitHub Dependabot alerts and runs uv lock --upgrade-package for each vulnerable package, then opens (or updates) a single PR with a detailed description of what was upgraded and what couldn't be. When the fix release is blocked by the project's exclude-newer cooldown, it adds a temporary exclude-newer-package entry for that release to pyproject.toml and removes it in a later PR once the release is older than the cooldown.

Prerequisites:

• Dependabot alerts must be enabled on the calling repository
• A GitHub PAT (classic) with repo scope is required (the default GITHUB_TOKEN cannot read Dependabot alerts)

Actions

security-updates (composite action)

Same functionality as the reusable workflow above (both run the same security-updates/update.py script), packaged as a composite action. This is the variant used by the Komorebi-AI repositories (via python-template).

Prerequisites:

• Dependabot alerts must be enabled on the calling repository
• The komorebi-security-bot GitHub App installed on the repository, with its ID and private key stored as the repository (or organization) secrets SECURITY_APP_ID and SECURITY_APP_PRIVATE_KEY. The action exchanges them for an installation token (via actions/create-github-app-token), so branches are pushed and PRs opened as the App.

Inputs: app-id and private-key (required), branch-name, pr-title, uv-version.

Usage

Simplest example. Python version is read from .python-version file and uv is set to the latest version:

jobs:
  pytest:
    uses: Komorebi-AI/github-actions/.github/workflows/pytest-uv.yml@main

More complex example, passing arguments:

jobs:
  pytest:
    strategy:
      matrix:
        python-version: ["3.10", "3.11", "3.12"]
    uses: Komorebi-AI/github-actions/.github/workflows/pytest-uv.yml@main
    with:
      uv-version: 0.8.0
      python-version: ${{ matrix.python-version }}
      debug-enabled: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
    secrets:
      codecov-token: ${{ secrets.CODECOV_TOKEN }}
      ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}

prek example. By default runs hooks on all files (--all-files). To run only on changed files in a PR, pass --from-ref and --to-ref via prek-args:

jobs:
  prek:
    uses: Komorebi-AI/github-actions/.github/workflows/prek.yml@main
    with:
      prek-args: --from-ref ${{ github.event.pull_request.base.sha }} --to-ref ${{ github.event.pull_request.head.sha }}

Security update example. The calling workflow provides the schedule and triggers, and passes a PAT with repo scope:

name: Security Update

on:
  schedule:
    - cron: '0 * * * *'
  workflow_dispatch:

jobs:
  security:
    uses: Komorebi-AI/github-actions/.github/workflows/security-updates.yml@main
    secrets:
      token: ${{ secrets.RENOVATE_TOKEN }}

With all options:

jobs:
  security:
    uses: Komorebi-AI/github-actions/.github/workflows/security-updates.yml@main
    with:
      uv-version: 0.8.0
      branch-name: security/dependency-updates
      pr-title: "Security: upgrade vulnerable dependencies"
      debug-enabled: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
    secrets:
      token: ${{ secrets.RENOVATE_TOKEN }}
      ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}

Security update as a composite action (as in python-template). The caller defines the job, schedule and checkout, and uses the action at the step level:

name: Security Updates

on:
  schedule:
    - cron: "37 3 * * 1"
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  security-updates:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: Komorebi-AI/github-actions/security-updates@main
        with:
          app-id: ${{ secrets.SECURITY_APP_ID }}
          private-key: ${{ secrets.SECURITY_APP_PRIVATE_KEY }}
          pr-title: "security: upgrade vulnerable dependencies"
          uv-version: 0.13.4

See other usage examples in the Komorebi-AI/python-template repository:

• prek-main.yml
• prek-pr.yml
• pytest.yml

Common inputs

All inputs are optional, these are the default values:

• uv-version: use latest version
• python-version: look at .python-version or pyproject.toml file
• debug-enabled: false

Secrets

Secrets are also optional:

• if codecov-token is set coverage will be computed and uploaded to Codecov
• if ssh-private-key is set dependencies can be installed from Github repositories inside the Komorebi-AI organization using SSH (via the ssh-agent Github Action)
• token is required for the security-updates reusable workflow — a GitHub PAT (classic) with repo scope, used to read Dependabot alerts, push branches, and create/update PRs. The composite action takes the GitHub App credentials as inputs instead (see above).

To pass all secrets to called workflow use secrets: inherit.

References

• Avoiding duplication
• Reuse workflows
• Reusable workflows reference
• Allowing access to Github Actions