From 7b2f676894452164f57b66ee0254418b1a6c2941 Mon Sep 17 00:00:00 2001
From: Ronny Trommer <ronny@no42.org>
Date: Tue, 28 Jul 2026 17:20:06 +0200
Subject: [PATCH] feat(ci): add weekly audit watcher for scoped-gate revert

The Dependabot alert for GHSA-mh99-v99m-4gvg was auto-dismissed
(dev-scoped), so no security-update PR will announce a brace-expansion
1.x backport, and version updates don't touch lockfile-only transitive
deps. Nothing signals when the full tree is clean again.

Add an audit-full Makefile target (full-tree npm audit) and a weekly
scheduled workflow that runs it non-gating and comments on #138 once it
passes, so the --omit=dev gate scoping gets reverted promptly. Delete
both with the revert.

Refs #138

Assisted-by: ClaudeCode:claude-fable-5
Signed-off-by: Ronny Trommer <ronny@no42.org>
---
 .github/workflows/audit-watch.yml | 42 +++++++++++++++++++++++++++++++
 Makefile                          |  5 +++-
 2 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/audit-watch.yml

diff --git a/.github/workflows/audit-watch.yml b/.github/workflows/audit-watch.yml
new file mode 100644
index 0000000..e2de1d9
--- /dev/null
+++ b/.github/workflows/audit-watch.yml
@@ -0,0 +1,42 @@
+# Watches for the full dependency tree becoming audit-clean again while the
+# CI audit gate is scoped to --omit=dev (GHSA-mh99-v99m-4gvg, see #138).
+# Comments on #138 when the revert can happen; delete this file with the revert.
+name: Audit watch
+
+on:
+  schedule:
+    - cron: '37 5 * * 1'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  watch:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        with:
+          node-version: 20
+          cache: npm
+      - id: audit
+        run: |
+          if make audit-full; then
+            echo "clean=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "clean=false" >> "$GITHUB_OUTPUT"
+          fi
+      - if: steps.audit.outputs.clean == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh issue comment 138 --repo "$GITHUB_REPOSITORY" --body \
+            "Full-tree \`npm audit --audit-level=high\` is clean — the scoped audit gate can be reverted. Follow the revert steps in the decision record above. This comment repeats weekly until the revert lands."
diff --git a/Makefile b/Makefile
index 5dc4282..f4f5f57 100644
--- a/Makefile
+++ b/Makefile
@@ -8,7 +8,7 @@ IMAGE_TAG  ?= rc
 ENV_FILE_ARG := $(if $(wildcard .env),--env-file .env,)
 LIBRARY_MOUNT_ARG := $(if $(wildcard ./mods),-v $(CURDIR)/mods:/library:ro -e LIBRARY_ROOT=/library,)
 
-.PHONY: help install dev lint typecheck audit build test e2e verify format format-check image run clean
+.PHONY: help install dev lint typecheck audit audit-full build test e2e verify format format-check image run clean
 
 help: ## Show this help
 	@awk 'BEGIN {FS=":.*?## "} /^[a-zA-Z_-]+:.*?## /{printf "  \033[36m%-14s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
@@ -30,6 +30,9 @@ typecheck: install ## Run TypeScript compiler in check-only mode
 audit: install ## Run npm audit on production deps (fails on high or critical)
 	npm audit --omit=dev --audit-level=high
 
+audit-full: install ## Run npm audit on the full tree incl. dev deps (watched by audit-watch.yml, see #138)
+	npm audit --audit-level=high
+
 build: install ## Build the Next.js app
 	npm run build