feat(ci): add weekly audit watcher for scoped-gate revert

.github/workflows/audit-watch.yml

@@ -0,0 +1,42 @@
+# Watches for the full dependency tree becoming audit-clean again while the
+# CI audit gate is scoped to --omit=dev (GHSA-mh99-v99m-4gvg, see #138).
+# Comments on #138 when the revert can happen; delete this file with the revert.
+name: Audit watch
+
+on:
+  schedule:
+    - cron: '37 5 * * 1'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  watch:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        with:
+          node-version: 20
+          cache: npm
+      - id: audit
+        run: |
+          if make audit-full; then
+            echo "clean=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "clean=false" >> "$GITHUB_OUTPUT"
+          fi
+      - if: steps.audit.outputs.clean == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh issue comment 138 --repo "$GITHUB_REPOSITORY" --body \
+            "Full-tree \`npm audit --audit-level=high\` is clean — the scoped audit gate can be reverted. Follow the revert steps in the decision record above. This comment repeats weekly until the revert lands."

Makefile

@@ -8,7 +8,7 @@ IMAGE_TAG  ?= rc
 ENV_FILE_ARG := $(if $(wildcard .env),--env-file .env,)
 LIBRARY_MOUNT_ARG := $(if $(wildcard ./mods),-v $(CURDIR)/mods:/library:ro -e LIBRARY_ROOT=/library,)
 
-.PHONY: help install dev lint typecheck audit build test e2e verify format format-check image run clean
+.PHONY: help install dev lint typecheck audit audit-full build test e2e verify format format-check image run clean
 
 help: ## Show this help
 	@awk 'BEGIN {FS=":.*?## "} /^[a-zA-Z_-]+:.*?## /{printf "  \033[36m%-14s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
@@ -30,6 +30,9 @@ typecheck: install ## Run TypeScript compiler in check-only mode
 audit: install ## Run npm audit on production deps (fails on high or critical)
 	npm audit --omit=dev --audit-level=high
 
+audit-full: install ## Run npm audit on the full tree incl. dev deps (watched by audit-watch.yml, see #138)
+	npm audit --audit-level=high
+
 build: install ## Build the Next.js app
 	npm run build