Create a monthly dependency audit agentic workflow

[rak-phillip]

Create an agentic workflow that performs a monthly audit of repository dependencies and files a github issue based on the findings.

Goals

• Continuous reduction of dependency bloat
• Prevent accidental exposure of transitive dependencies
• Improve long-term maintainability

Acceptance criteria

• Monthly issues are generated with high-confidence findings
• Reduction of unused dependency throughout Dashboard, shell, and other packages
• Dependencies are placed an properly categorized as a result of the workflow

Additional context

This is a follow-up to #17622

[github-actions]

🎯 Agentic Issue Triage

Summary: This is a feature request to create a monthly automated agentic workflow that audits repository dependencies and files GitHub issues with findings. It's a follow-up to #17622 (Remove unused and misplaced dependencies), aiming to make dependency hygiene a recurring, automated process rather than a one-off effort.

Type: Feature / Automation / Developer Experience

---

📋 Issue Breakdown & Checklist

• Design the workflow trigger (GitHub Actions schedule with cron for monthly runs)
• Implement dependency audit logic (detect unused, misplaced, and transitive deps across shell/, pkg/, root package.json)
• Integrate with a tool such as depcheck or a custom script to scan imports vs declared dependencies
• Auto-file a GitHub issue with structured findings (unused deps, misplaced deps, potentially risky transitive deps)
• Include confidence scoring so only high-confidence findings are surfaced
• Ensure the workflow runs against all relevant packages (Dashboard root, shell/, pkg/*)
• Add deduplication logic to avoid filing duplicate issues if findings were already reported
• Write tests or validation for the audit script logic

🔍 Context & Related Issues

• This is a follow-up to Remove unused and misplaced dependencies #17622 (Remove unused and misplaced dependencies), which itself spawned several sub-issues (Remove unused cookie dependencies #17624, Remove unused browser polyfill dependencies #17625, Remove unused utility dependencies #17626, Relocate misplaced dependencies from dependencies to devDependencies #17623, Remove unused vue-server-renderer #17610).
• The parent issue Remove unused and misplaced dependencies #17622 identifies the categories of problems to detect: unused imports, misplaced deps (prod vs dev), and redundant packages.
• Issue Remove unused utility dependencies #17626 specifically lists utilities with no source imports (d3-selection, url-parse, shell-quote, jsdiff) — these are exactly the kinds of findings the new workflow should catch automatically.

🛠️ Implementation Suggestions

Recommended tool: depcheck

• Detects unused dependencies and missing dependencies by scanning source imports.
• Can be run per-workspace in a monorepo setup.
• Example: npx depcheck ./shell --json

Workflow outline (.github/workflows/dependency-audit.yml):

on:
  schedule:
    - cron: '0 9 1 * *'  # 1st of every month at 09:00 UTC
  workflow_dispatch:

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: yarn install --frozen-lockfile
      - run: node scripts/dependency-audit.js
        # script collects findings and calls GH API to file issue

Issue filing: Use the GitHub API (via gh issue create or octokit) with a structured template. Include package name, location, and reason for flagging.

Confidence filtering: Only report deps where:

• No import/require found in source files
• Not referenced in config files (e.g., babel.config.js, vue.config.js, jest.config.js)
• Not a peer dependency or indirect requirement

🧪 Debugging / Validation Strategy

• Dry-run the audit script locally before wiring it into CI to verify findings against known removals from Remove unused and misplaced dependencies #17622.
• Cross-reference audit output with the sub-issues of Remove unused and misplaced dependencies #17622 to ensure known unused deps are caught.
• Test the issue-filing logic with a workflow_dispatch trigger before relying on the monthly schedule.
• Validate that the workflow handles monorepo workspace boundaries correctly (root vs shell/ vs pkg/*).

🔗 Useful Resources

• depcheck docs
• GitHub Actions scheduled events
• [Octokit REST — create an issue]((octokit.github.io/redacted)
• [Yarn workspaces]((yarnpkg.com/redacted) — relevant for scanning all packages
• Parent issue #17622 for reference on categories of findings

Generated by Agentic Triage for issue #17832 · ● 201.6K · ◷

[github-actions]

🤖 Issue grooming analysis

All four primary grooming criteria are satisfied:

1. Clear Problem Statement ✅
The title and description clearly explain the goal: an agentic workflow that performs monthly dependency audits and files GitHub issues with findings. The motivation (reducing bloat, preventing transitive exposure, improving maintainability) is well articulated.

2. Acceptance Criteria ✅
Three concrete, checkable AC items are present:

• Monthly issues generated with high-confidence findings
• Reduction of unused dependencies across Dashboard, shell, and other packages
• Dependencies are properly placed and categorized as a result of the workflow

3. Technical Details ✅
Scoped to Dashboard, shell, and other packages. References the related prior work in #17622, providing sufficient context for an engineer to understand the intended shape of the solution.

4. Reproducibility / User Story ✅
This is a feature request. The desired workflow behavior (monthly run → audit → file issue) is clearly described — no repro steps needed.

5. Dependencies ✅
Follows up on #17622.

This analysis was generated automatically based on the repository's grooming checklist.

Generated by Daily Issue Grooming · ● 688.2K · ◷