From 0895c4cbe6ff960b23626a538d1691d2ebf51311 Mon Sep 17 00:00:00 2001
From: Jamie Hill-Daniel <jamie@osec.io>
Date: Mon, 19 Jan 2026 04:48:23 +0000
Subject: [PATCH] ci: Move lockfile updates to a script

---
 .github/workflows/dependencies.yml | 16 +++-------------
 src/tools/update-lockfile.sh       | 18 ++++++++++++++++++
 2 files changed, 21 insertions(+), 13 deletions(-)
 create mode 100755 src/tools/update-lockfile.sh

diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
index 80ffd67e04e1..7c721c7abeaa 100644
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -62,19 +62,9 @@ jobs:
           rustup toolchain install --no-self-update --profile minimal $TOOLCHAIN
           rustup default $TOOLCHAIN
 
-      - name: cargo update compiler & tools
-        # Remove first line that always just says "Updating crates.io index"
-        run: |
-          echo -e "\ncompiler & tools dependencies:" >> cargo_update.log
-          cargo update 2>&1 | sed '/crates.io index/d' | tee -a cargo_update.log
-      - name: cargo update library
-        run: |
-          echo -e "\nlibrary dependencies:" >> cargo_update.log
-          cargo update --manifest-path library/Cargo.toml 2>&1 | sed '/crates.io index/d' | tee -a cargo_update.log
-      - name: cargo update rustbook
-        run: |
-          echo -e "\nrustbook dependencies:" >> cargo_update.log
-          cargo update --manifest-path src/tools/rustbook/Cargo.toml 2>&1 | sed '/crates.io index/d' | tee -a cargo_update.log
+      - name: cargo update
+        run: ./src/tools/update-lockfile.sh
+
       - name: upload Cargo.lock artifact for use in PR
         uses: actions/upload-artifact@v4
         with:
diff --git a/src/tools/update-lockfile.sh b/src/tools/update-lockfile.sh
new file mode 100755
index 000000000000..a968d83d8152
--- /dev/null
+++ b/src/tools/update-lockfile.sh
@@ -0,0 +1,18 @@
+#!/bin/sh
+
+# Updates the workspaces in `.`, `library` and `src/tools/rustbook`
+# Logs are written to `cargo_update.log`
+# Used as part of regular dependency bumps
+
+set -euo pipefail
+
+echo -e "\ncompiler & tools dependencies:" > cargo_update.log
+# Remove first line that always just says "Updating crates.io index"
+cargo update 2>&1 | sed '/crates.io index/d' | \
+    tee -a cargo_update.log
+echo -e "\nlibrary dependencies:" >> cargo_update.log
+cargo update --manifest-path library/Cargo.toml 2>&1 | sed '/crates.io index/d' | \
+    tee -a cargo_update.log
+echo -e "\nrustbook dependencies:" >> cargo_update.log
+cargo update --manifest-path src/tools/rustbook/Cargo.toml 2>&1 | sed '/crates.io index/d' | \
+    tee -a cargo_update.log