Security Audit #339

	name: Security Audit

	on:
	schedule:
	# Run daily at 2 AM UTC
	- cron: '0 2 * * *'
	push:
	branches: [main]
	paths:
	- 'package*.json'
	pull_request:
	branches: [main]
	paths:
	- 'package*.json'
	workflow_dispatch:

	jobs:
	audit:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v5

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version: '20'
	cache: 'npm'

	- name: Run npm audit
	run: npm audit --audit-level=moderate
	continue-on-error: true

	- name: Run npm audit fix (dry run)
	run: npm audit fix --dry-run --audit-level=moderate
	continue-on-error: true

	- name: Create issue for vulnerabilities
	if: failure()
	uses: actions/github-script@v7
	with:
	script: \|
	const title = '🚨 Security vulnerabilities detected';
	const body = `Security audit found vulnerabilities in dependencies.

	Please run:
	\`\`\`bash
	npm audit fix
	\`\`\`

	Or manually update the affected packages.

	Check the [workflow run](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}) for details.`;

	// Check if issue already exists
	const issues = await github.rest.issues.listForRepo({
	owner: context.repo.owner,
	repo: context.repo.repo,
	state: 'open',
	labels: 'security'
	});

	const existingIssue = issues.data.find(issue => issue.title === title);

	if (!existingIssue) {
	await github.rest.issues.create({
	owner: context.repo.owner,
	repo: context.repo.repo,
	title,
	body,
	labels: ['security', 'dependencies']
	});
	}

Provide feedback