audit-fix.yml

name: Weekly Audit Fix

on:
  schedule:
    - cron: '0 9 * * 1'  # Every Monday at 9am UTC
  workflow_dispatch:       # Manual trigger

permissions:
  contents: write

jobs:
  audit-fix:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v6
        with:
          node-version: '20'

      - run: npm ci

      - name: Run npm audit fix
        run: npm audit fix || true

      - name: Check for changes
        id: changes
        run: |
          if git diff --quiet package-lock.json; then
            echo "changed=false" >> $GITHUB_OUTPUT
          else
            echo "changed=true" >> $GITHUB_OUTPUT
          fi

      - name: Commit and push
        if: steps.changes.outputs.changed == 'true'
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add package-lock.json
          git commit -m "fix: automated npm audit fix (weekly)"
          git push