BumpPilot: Pip Dependency Updates in Kestra

id: bump-pilot
namespace: company.team

description: |
  BumpPilot checks requirements.txt once a week and opens a pull request
  for whatever is outdated. It asks PyPI for the latest version of each
  pinned package, skips anything that already has an open bump PR, and
  stays quiet when everything is current.

inputs:
  - id: repo_owner
    type: STRING
    description: who owns the repo, like kestra-io
  - id: repo_name
    type: STRING
    description: the repo name, like kestra
  - id: requirements_path
    type: STRING
    description: where the requirements file lives in the repo
    defaults: requirements.txt
  - id: base_branch
    type: STRING
    description: the branch the bump branch starts from
    defaults: main

tasks:
  - id: fetch_requirements
    type: io.kestra.plugin.core.http.Request
    description: asks GitHub for the requirements.txt file
    method: GET
    uri: https://api.github.com/repos/{{ inputs.repo_owner }}/{{ inputs.repo_name
      }}/contents/{{ inputs.requirements_path }}?ref={{ inputs.base_branch }}
    headers:
      Authorization: "Bearer {{ secret('GITHUB_TOKEN') }}"
      Accept: "application/vnd.github+json"

  - id: get_base_sha
    type: io.kestra.plugin.core.http.Request
    description: asks GitHub for the latest commit on the base branch, new branches
      start from here
    method: GET
    uri: https://api.github.com/repos/{{ inputs.repo_owner }}/{{ inputs.repo_name
      }}/git/ref/heads/{{ inputs.base_branch }}
    headers:
      Authorization: "Bearer {{ secret('GITHUB_TOKEN') }}"
      Accept: "application/vnd.github+json"

  - id: list_open_prs
    type: io.kestra.plugin.core.http.Request
    description: asks GitHub for the open pull requests, so it never opens a
      duplicate bump PR
    method: GET
    uri: https://api.github.com/repos/{{ inputs.repo_owner }}/{{ inputs.repo_name
      }}/pulls?state=open&per_page=100
    headers:
      Authorization: "Bearer {{ secret('GITHUB_TOKEN') }}"
      Accept: "application/vnd.github+json"

  - id: find_outdated
    type: io.kestra.plugin.scripts.python.Script
    description: reads the file line by line, checks each pin against PyPI, and
      returns what is outdated
    taskRunner:
      type: io.kestra.plugin.scripts.runner.docker.Docker
    containerImage: python:3.11
    dependencies:
      - kestra
    script: |
      import base64
      import json
      import urllib.request
      from datetime import datetime, timezone
      from kestra import Kestra


      def parse_version(v):
          # compare versions as numbers, so 10.0 beats 9.0
          parts = []
          for piece in v.split('.'):
              num = ''
              for ch in piece:
                  if ch.isdigit():
                      num += ch
                  else:
                      break
              parts.append(int(num) if num else 0)
          return tuple(parts)


      # GitHub sends the file base64-encoded, so decode it first
      raw = base64.b64decode("""{{ outputs.fetch_requirements.body | jq(".content") | first }}""").decode()

      # go line by line and keep the name and version pairs
      pins = []
      for line in raw.splitlines():
          line = line.strip()
          if not line or line.startswith('#') or '==' not in line:
              continue
          name, version = line.split('==', 1)
          pins.append((name.strip(), version.strip()))

      # ask PyPI for the latest version of each pinned package
      outdated = []
      for name, current in pins:
          try:
              with urllib.request.urlopen(f'https://pypi.org/pypi/{name}/json', timeout=15) as r:
                  latest = json.load(r)['info']['version']
          except Exception:
              continue  # not on PyPI, skip it quietly
          if parse_version(latest) > parse_version(current):
              outdated.append({'name': name, 'current': current, 'latest': latest})

      # skip anything that already has an open bump PR
      open_titles = json.loads("""{{ outputs.list_open_prs.body | jq("[.[].title]") | first }}""")
      fresh = [o for o in outdated if not any(o['name'] in t for t in open_titles)]

      # write the new requirements.txt with the bumped versions
      new_lines = []
      for line in raw.splitlines():
          stripped = line.strip()
          if '==' in stripped and not stripped.startswith('#'):
              name = stripped.split('==', 1)[0].strip()
              bump = next((o for o in fresh if o['name'] == name), None)
              if bump:
                  line = f"{name}=={bump['latest']}"
          new_lines.append(line)

      new_content = base64.b64encode('\n'.join(new_lines).encode()).decode()
      branch_name = datetime.now(timezone.utc).strftime('bump/deps-%Y%m%d-%H%M%S')
      bump_names = ', '.join(o['name'] for o in fresh)

      pr_lines = ['BumpPilot found outdated dependencies:', '']
      for o in fresh:
          pr_lines.append(f"- {o['name']}: {o['current']} -> {o['latest']}")
      pr_lines += ['', '_Opened automatically by BumpPilot._']
      pr_body = '\\n'.join(pr_lines)

      Kestra.outputs({
          'outdated': fresh,
          'count': len(fresh),
          'new_content': new_content,
          'branch_name': branch_name,
          'bump_names': bump_names,
          'pr_body': pr_body,
      })

  - id: process_updates
    type: io.kestra.plugin.core.flow.If
    description: only does anything when something is actually outdated
    condition: "{{ outputs.find_outdated.vars.count > 0 }}"
    then:
      - id: create_branch
        type: io.kestra.plugin.core.http.Request
        description: makes the bump branch from the base branch
        method: POST
        uri: https://api.github.com/repos/{{ inputs.repo_owner }}/{{ inputs.repo_name
          }}/git/refs
        headers:
          Authorization: "Bearer {{ secret('GITHUB_TOKEN') }}"
          Accept: "application/vnd.github+json"
        contentType: application/json
        body: |
          {
            "ref": "refs/heads/{{ outputs.find_outdated.vars.branch_name }}",
            "sha": "{{ outputs.get_base_sha.body | jq('.object.sha') | first }}"
          }

      - id: update_file
        type: io.kestra.plugin.core.http.Request
        description: writes the bumped requirements.txt to the new branch
        method: PUT
        uri: https://api.github.com/repos/{{ inputs.repo_owner }}/{{ inputs.repo_name
          }}/contents/{{ inputs.requirements_path }}
        headers:
          Authorization: "Bearer {{ secret('GITHUB_TOKEN') }}"
          Accept: "application/vnd.github+json"
        contentType: application/json
        body: |
          {
            "message": "chore: bump dependencies",
            "content": "{{ outputs.find_outdated.vars.new_content }}",
            "sha": "{{ outputs.fetch_requirements.body | jq('.sha') | first }}",
            "branch": "{{ outputs.find_outdated.vars.branch_name }}"
          }

      - id: open_pr
        type: io.kestra.plugin.core.http.Request
        description: opens the pull request with the bumped dependencies
        method: POST
        uri: https://api.github.com/repos/{{ inputs.repo_owner }}/{{ inputs.repo_name
          }}/pulls
        headers:
          Authorization: "Bearer {{ secret('GITHUB_TOKEN') }}"
          Accept: "application/vnd.github+json"
        contentType: application/json
        body: |
          {
            "title": "chore: bump {{ outputs.find_outdated.vars.bump_names }}",
            "head": "{{ outputs.find_outdated.vars.branch_name }}",
            "base": "{{ inputs.base_branch }}",
            "body": "{{ outputs.find_outdated.vars.pr_body }}"
          }

triggers:
  - id: weekly
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "0 9 * * 1"
    timezone: UTC
    inputs:
      repo_owner: kestra-io
      repo_name: kestra
      requirements_path: requirements.txt
      base_branch: main

Pinned Python dependencies go stale quietly. Nobody checks requirements.txt every week, so projects end up running old versions with known bugs until something breaks. This blueprint turns a scheduled PyPI check into an automatic bump PR: it reads the requirements file, asks PyPI for the latest version of each pin, and opens one pull request with the updates.

How it works

fetch_requirements (io.kestra.plugin.core.http.Request) asks the GitHub API for the requirements file on the base branch. GitHub returns the file base64-encoded.
get_base_sha (io.kestra.plugin.core.http.Request) asks the GitHub API for the latest commit on the base branch. The new bump branch starts from this commit.
list_open_prs (io.kestra.plugin.core.http.Request) asks the GitHub API for the repo's open pull requests, so the flow never opens a duplicate bump PR.
find_outdated (io.kestra.plugin.scripts.python.Script) decodes the file, goes line by line through the == pins, asks PyPI for each package's latest version, and keeps only the outdated ones that do not already have an open bump PR. It also builds the updated file content and the new branch name.
process_updates (io.kestra.plugin.core.flow.If) runs only when something is outdated. Inside it, create_branch makes the bump branch, update_file writes the new requirements file to it, and open_pr opens the pull request.

What you get

A scheduled PyPI check for every pinned package in requirements.txt.
One pull request per run with all the outdated pins bumped, never two PRs for the same package.
A quiet run when everything is already current: no branches, no PRs, no noise.

Who it's for

Teams with Python services whose requirements.txt only gets updated when someone remembers.
Maintainers who want dependency updates as reviewable PRs instead of surprise breakages.
Anyone who has been bitten by running an old pinned version in production.

Why orchestrate this with Kestra

Dependabot covers this on GitHub, but its behavior is fixed and it only watches what GitHub tells it to. Kestra keeps the whole thing in one visible flow: the schedule, the PyPI version check, the duplicate-PR guard, and the branch and PR creation are all one auditable execution history, and every step is editable. You can point it at any pins file, add an ignore list, or change the schedule without asking a bot for permission.

Prerequisites

A GitHub repo with a requirements.txt (or a similarly formatted pins file).
A Kestra instance with Docker, because the version check runs in a Python container.

Secrets

GITHUB_TOKEN: GitHub personal access token with repo scope. The flow creates branches, writes files, and opens pull requests. In Kestra OSS, secrets are supplied as environment variables prefixed SECRET_, base64-encoded, and read back with {{ secret('NAME') }}, for example SECRET_GITHUB_TOKEN=$(echo -n '<token>' | base64).

Quick start

Save your GitHub token as the GITHUB_TOKEN secret (base64-encoded, see above).
Import the flow and hit Execute. Type the repo owner and repo name when it asks; the file path and branch already have defaults.
Check the execution: if anything was outdated, a bump PR is now open on the repo.
The Monday schedule takes care of the rest.

How to extend

Point requirements_path at a different pins file, like requirements-dev.txt.
Add an ignore_packages input and skip those pins in the Python step.
Change the schedule to run more or less often.

Inputs

repo_owner: who owns the repo.
repo_name: the repo name.
requirements_path: where the requirements file lives (defaults to requirements.txt).
base_branch: the branch the bump branch starts from (defaults to main).

Pitfalls

PyPI's JSON API is unauthenticated and rate-limited; a requirements file with hundreds of pins can take a while or get throttled.
If a maintainer closes a bump PR without merging, the next run will propose it again, because closing is not the same as merging.