diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..8ac6b8c
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+ - package-ecosystem: "github-actions"
+ directory: "/"
+ schedule:
+ interval: "monthly"
diff --git a/.github/workflows/dependency-update.yml b/.github/workflows/dependency-update.yml
new file mode 100644
index 0000000..d8aaa4a
--- /dev/null
+++ b/.github/workflows/dependency-update.yml
@@ -0,0 +1,188 @@
+name: Dependency Update Check
+
+on:
+ schedule:
+ - cron: '0 9 * * 1' # Every Monday 09:00 UTC
+ workflow_dispatch:
+
+concurrency:
+ group: dependency-update
+ cancel-in-progress: false
+
+permissions:
+ contents: write
+ pull-requests: write
+
+jobs:
+ check-and-pr:
+ name: Check dependencies & open PR
+ runs-on: ubuntu-latest
+ outputs:
+ has_updates: ${{ steps.check.outputs.has_updates }}
+ pr_branch: ${{ steps.pr.outputs.branch }}
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+
+ - name: Setup Python
+ uses: actions/setup-python@v5
+ with:
+ python-version: "3.x"
+
+ - name: Install tools
+ run: |
+ sudo apt-get update
+ sudo apt-get install -y jq curl bats bc shellcheck dmidecode fio \
+ iproute2 lshw util-linux ethtool hwloc pciutils numactl smartmontools
+ pip install pre-commit
+
+ - name: Check for updates
+ id: check
+ run: |
+ report=$(bash scripts/check-updates.sh --json 2>/dev/null)
+ echo "$report" > update-report.json
+ count=$(echo "$report" | jq '.summary.updates_available')
+ echo "update_count=$count" >> "$GITHUB_OUTPUT"
+ if [ "$count" -gt 0 ]; then
+ echo "has_updates=true" >> "$GITHUB_OUTPUT"
+ echo "### Dependencies: $count update(s) available" >> "$GITHUB_STEP_SUMMARY"
+ jq -r '.dependencies[] | select(.update_available==true) | "- **\(.name)**: \(.current_version) → \(.latest_version)"' update-report.json >> "$GITHUB_STEP_SUMMARY"
+ else
+ echo "has_updates=false" >> "$GITHUB_OUTPUT"
+ echo "All dependencies up to date." >> "$GITHUB_STEP_SUMMARY"
+ fi
+
+ - name: Apply updates
+ if: steps.check.outputs.has_updates == 'true'
+ run: bash scripts/check-updates.sh --apply
+
+ - name: Validate — lint
+ if: steps.check.outputs.has_updates == 'true'
+ run: make lint
+
+ - name: Validate — unit tests
+ if: steps.check.outputs.has_updates == 'true'
+ run: make test
+
+ - name: Validate — static checks
+ if: steps.check.outputs.has_updates == 'true'
+ run: make static-checks
+
+ - name: Validate — smoke run
+ if: steps.check.outputs.has_updates == 'true'
+ run: sudo bash scripts/run-all.sh --smoke --ci
+
+ - name: Create or update PR
+ id: pr
+ if: steps.check.outputs.has_updates == 'true'
+ env:
+ GH_TOKEN: ${{ github.token }}
+ run: |
+ git config user.name "github-actions[bot]"
+ git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+ BRANCH="deps/auto-update-$(date +%Y%m%d)"
+
+ # Check for existing open dependency update PR
+ existing_branch=$(gh pr list --label dependencies --state open \
+ --json headRefName -q '.[0].headRefName // empty' 2>/dev/null || true)
+
+ if [ -n "$existing_branch" ]; then
+ BRANCH="$existing_branch"
+ git checkout -B "$BRANCH"
+ else
+ git checkout -b "$BRANCH"
+ fi
+ echo "branch=$BRANCH" >> "$GITHUB_OUTPUT"
+
+ git add -A
+
+ # Build commit message
+ updates_list=$(jq -r '.dependencies[] | select(.update_available==true) | "- \(.name): \(.current_version) → \(.latest_version)"' update-report.json)
+ git commit -m "deps: update dependencies ($(date +%Y-%m-%d))" -m "$updates_list" || true
+
+ git push -u origin "$BRANCH" --force-with-lease
+
+ # Build PR body
+ pr_body=$(cat <<'BODY_END'
+ ## Automated Dependency Update
+
+ | Dependency | Current | Latest | Category |
+ |------------|---------|--------|----------|
+ BODY_END
+ )
+ table_rows=$(jq -r '.dependencies[] | select(.update_available==true) | "| \(.name) | \(.current_version) | \(.latest_version) | \(.category) |"' update-report.json)
+ pr_body="${pr_body}
+ ${table_rows}
+
+ ### CI Validation
+ - [x] Lint (\`make lint\`)
+ - [x] Unit tests (\`make test\`)
+ - [x] Static checks (\`make static-checks\`)
+ - [x] Smoke run (\`run-all.sh --smoke --ci\`)
+ - [ ] **GPU validation** — merge only after a quick run on a GPU host
+
+ > Auto-generated by \`scripts/check-updates.sh\` via scheduled CI."
+
+ if [ -n "$existing_branch" ]; then
+ pr_number=$(gh pr list --head "$existing_branch" --state open --json number -q '.[0].number' 2>/dev/null || true)
+ if [ -n "$pr_number" ]; then
+ gh pr edit "$pr_number" --body "$pr_body"
+ echo "Updated existing PR #${pr_number}"
+ fi
+ else
+ gh pr create \
+ --title "deps: update dependencies ($(date +%Y-%m-%d))" \
+ --body "$pr_body" \
+ --label "dependencies" || echo "PR creation failed (label may not exist)"
+ fi
+
+ - name: Upload update report
+ if: always()
+ uses: actions/upload-artifact@v4
+ with:
+ name: dependency-update-report
+ path: update-report.json
+ if-no-files-found: ignore
+
+ gpu-validate:
+ name: GPU validation (self-hosted)
+ needs: check-and-pr
+ if: needs.check-and-pr.outputs.has_updates == 'true' && vars.HPC_ENABLE_GPU_CI == '1'
+ runs-on: [self-hosted, linux, x64, gpu, nvidia]
+ steps:
+ - name: Checkout update branch
+ uses: actions/checkout@v4
+ with:
+ ref: ${{ needs.check-and-pr.outputs.pr_branch }}
+
+ - name: Run quick on GPU host
+ run: sudo bash scripts/run-all.sh --quick --ci
+
+ - name: Post GPU results to PR
+ if: always()
+ env:
+ GH_TOKEN: ${{ github.token }}
+ run: |
+ pr_number=$(gh pr list --head "${{ needs.check-and-pr.outputs.pr_branch }}" \
+ --state open --json number -q '.[0].number' 2>/dev/null || true)
+ result_file="/var/log/hpc-bench/results/run-all.json"
+ if [ -n "$pr_number" ] && [ -f "$result_file" ]; then
+ acceptance=$(jq -r '.acceptance // "unknown"' "$result_file")
+ gh pr comment "$pr_number" --body "### GPU Validation: ${acceptance}
+ Quick-mode results from self-hosted GPU runner.
+ Full results JSON
+
+ \`\`\`json
+ $(jq '.' "$result_file")
+ \`\`\`
+