Add automated KomaMRI dependency update workflow

[anvika-singhal]

Adds a fully automated weekly workflow that resolves KomaMRI and its dependencies, updates juliapkg.json, bumps the Python patch version, auto-merges the PR, creates a git tag, and triggers Publish workflow to publish to PyPI. Addresses JuliaHealth/KomaMRI.jl#733.

Included

.github/workflows/update-deps.yml

• Scheduled to run weekly (Sunday at midnight UTC)
• Manually triggerable via workflow dispatch
• Resolves KomaMRI, KomaMRIBase, KomaMRICore, KomaMRIFiles, KomaMRIPlots using Julia's Pkg resolver
• If versions changed:
  • Updates src/komamripy/juliapkg.json
  • Bumps Python patch version in pyproject.toml
  • Opens PR titled [auto] Bump to version X.X.X with version diff
  • Auto-merges PR (squash) once CI passes
    • If CI fails, holds here. PR remains open. Auto-publish still triggered when CI eventually manually merged.
• If no changes: exits cleanly, no PR created

.github/workflows/tag-release.yml (new)

• Triggered when PR with title startsWith [auto] Bump to version is merged
• Creates git tag vX.X.X from merged commit
• Pushes tag to origin
• Tag push automatically triggers existing Publish workflow

scripts/update_deps.py

• Resolves Julia packages using Julia's Pkg resolver
• Compares resolved versions with current juliapkg.json
• Updates both files if versions changed
• No external dependencies (uses only Python stdlib)
• Silent execution (no output on success)

Full Automation Flow

1. Weekly Schedule → update-deps.yml runs
2. Resolve Versions → Script checks latest compatible KomaMRI versions
3. Detect Changes → If versions bumped:
   • Create [auto] Bump to version X.X.X PR
   • Include version diff in PR body
4. Run CI → Tests, linting, and smoke tests on PR
5. Auto-Merge → If all checks pass, PR auto-merges (squash)
6. Tag Release → tag-release.yml creates and pushes vX.X.X tag
7. Publish → Existing Publish workflow auto-publishes to PyPI

Notes

• Automated bumps (via this workflow): PR title [auto] Bump to version X.X.X → auto-merge → auto-tag → auto-publish
• Manual bumps (when needed): PR title Bump to version X.X.X → manual merge → manual tag → manual publish

The [auto] prefix ensures only dependency-driven releases are fully automated.

• If CI fails on the PR, auto-merge is blocked
• Tag only created after successful merge
• Publish only triggered by tag push
• No manual steps required for happy path