ProjectsCase Study

Author ยท 2025

CPython Patch PR Action

A GitHub Action that updates supported CPython patch-version pins and opens a reviewable pull request.

Open-source tool

TypeScriptGitHub Actions
CPython Scanv1
Pins found:012345
// Dockerfile
FROM python:3.12.1-slim3.12.2-slimDockerfile
// .github/workflows/ci.yml
python-version: "3.12.1""3.12.2"workflow
// pyproject.toml
requires-python = "==3.12.13.12.2pyproject"
// .python-version
3.12.13.12.2.python-version
// runtime.txt
python-3.12.13.12.2runtime
Resolve latest stable patch
-FROM python:3.12.1-slim
+FROM python:3.12.2-slim
-python-version: "3.12.1"
+python-version: "3.12.2"
Scans pins. Resolves latest patch. Opens an auditable PR.

Why I built it

Exact Python patch versions can appear in several files in the same repository. Updating them manually makes it easy to leave configuration inconsistent.

How it works

When the workflow runs, the action scans supported configuration formats, resolves the latest stable patch in the selected Python release series, and creates or updates a pull request with targeted changes. The implementation preserves relevant version suffixes and reports why an update was skipped.

Engineering focus

The core work is recognizing supported version pins, producing minimal edits and keeping repeated runs predictable. Offline inputs and explicit skip reasons make the behavior easier to inspect and test.

Configuration example

The source README documents this workflow step. It selects a Python release series and leaves the resulting pull request for review.

Snippetyaml
- name: Update supported CPython pins
  uses: casperkristiansson/python-version-patch-pr@v1
  with:
    track: "3.12"
    automerge: false

The documented default globs include Dockerfiles, workflow YAML, .python-version, runtime.txt and pyproject.toml. Recognition is limited to supported pin syntax; arbitrary strings, computed versions and unrelated dependencies are outside that scope. A patch update still needs the consuming project's checks.