ci(deps): run dependency updates weekly

Author: AbhiPrasad

.agents/skills/sdk-dependency-updates/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: sdk-dependency-updates
-description: "Review and refresh Braintrust Python SDK dependency update PRs, especially automated `chore(deps): daily dependency update` PRs. Use when Codex needs to inspect `py/pyproject.toml` and `py/uv.lock`, reproduce the workflow's label decision, decide whether provider `latest` cassettes need re-recording, run the exact nox sessions, and validate playback before merge."
+description: "Review and refresh Braintrust Python SDK dependency update PRs, especially automated `chore(deps): weekly dependency update` PRs. Use when Codex needs to inspect `py/pyproject.toml` and `py/uv.lock`, reproduce the workflow's label decision, decide whether provider `latest` cassettes need re-recording, run the exact nox sessions, and validate playback before merge."
 ---
 
 # SDK Dependency Updates
 
-Use this skill for dependency bump PRs in this repo, especially the daily automation from `.github/workflows/dependency-updates.yml`.
+Use this skill for dependency bump PRs in this repo, especially the weekly automation from `.github/workflows/dependency-updates.yml`.
 
 Keep the work narrow. These PRs should usually stay limited to:
 

.github/workflows/dependency-updates.yml

@@ -1,7 +1,7 @@
 name: Dependency updates
 on:
   schedule:
-    - cron: "0 6 * * 1-5" # weekdays 6am UTC
+    - cron: "0 6 * * 1" # Mondays 6am UTC
   workflow_dispatch:
 
 permissions:
@@ -36,16 +36,16 @@ jobs:
         id: date
         run: echo "date=$(date +%Y-%m-%d)" >> "$GITHUB_OUTPUT"
 
-      - name: Close stale daily dependency update PRs
+      - name: Close stale weekly dependency update PRs
         if: steps.labels.outputs.changed == 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CURRENT_BRANCH: deps/daily-update-${{ steps.date.outputs.date }}
+          CURRENT_BRANCH: deps/weekly-update-${{ steps.date.outputs.date }}
         run: |
           gh pr list \
             --state open \
             --json number,title,headRefName \
-            --jq ".[] | select(.title == \"chore(deps): daily dependency update\") | select(.headRefName != \"$CURRENT_BRANCH\") | .number" \
+            --jq ".[] | select(.title == \"chore(deps): weekly dependency update\") | select(.headRefName != \"$CURRENT_BRANCH\") | .number" \
           | while read -r pr; do
               echo "Closing stale dependency update PR #$pr"
               gh pr close "$pr" --comment "Superseded by a newer automated dependency update." --delete-branch
@@ -55,12 +55,12 @@ jobs:
         if: steps.labels.outputs.changed == 'true'
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
-          title: "chore(deps): daily dependency update"
+          title: "chore(deps): weekly dependency update"
           body: |
-            Automated daily dependency update via `python scripts/update-matrix-latest.py && uv lock --upgrade`.
+            Automated weekly dependency update via `python scripts/update-matrix-latest.py && uv lock --upgrade`.
 
             ${{ steps.labels.outputs.needs_rerecord == 'true' && '⚠️ **Provider SDK packages changed.** A human needs to re-record cassettes locally before merging.' || '✅ Only test infrastructure deps changed. Safe to merge if CI passes.' }}
-          branch: deps/daily-update-${{ steps.date.outputs.date }}
+          branch: deps/weekly-update-${{ steps.date.outputs.date }}
           labels: |
             dependencies
             ${{ steps.labels.outputs.needs_rerecord == 'true' && 'needs-cassette-rerecord' || 'auto-merge-candidate' }}

AGENTS.md

@@ -297,7 +297,7 @@ All nox session dependency pins are centralized in `py/pyproject.toml`:
 
 The `LATEST` sentinel in the noxfile maps to the `latest` key in the matrix table — it is no longer a floating install.
 
-A daily GitHub Actions workflow (`.github/workflows/dependency-updates.yml`) runs `uv lock --upgrade`, classifies changes by reading group names from `pyproject.toml`, and opens a PR labeled `needs-cassette-rerecord` (provider SDK bumps) or `auto-merge-candidate` (infra-only bumps).
+A weekly GitHub Actions workflow (`.github/workflows/dependency-updates.yml`) runs `uv lock --upgrade`, classifies changes by reading group names from `pyproject.toml`, and opens a PR labeled `needs-cassette-rerecord` (provider SDK bumps) or `auto-merge-candidate` (infra-only bumps).
 
 ## Editing Guidelines
 

py/pyproject.toml

@@ -278,7 +278,7 @@ conflicts = [
 #
 # Each key is a provider prefix.  The value is a dict mapping human-readable
 # version tags to the pip requirement string.  "latest" is pinned to an
-# explicit version and bumped by the daily dependency-update workflow.
+# explicit version and bumped by the weekly dependency-update workflow.
 # ---------------------------------------------------------------------------
 
 [tool.braintrust.matrix]

py/scripts/determine-dependency-update-labels.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Determine GitHub Actions outputs for the daily dependency update workflow.
+"""Determine GitHub Actions outputs for the weekly dependency update workflow.
 
 Inspects the working-tree diff of ``py/pyproject.toml`` and ``py/uv.lock`` to
 decide whether anything changed and, if so, whether any provider SDK pins