weekly-audit.yml

name: Weekly security audit

on:
  schedule:
    - cron: "0 9 * * 1" # Lunes 09:00 Europe/Madrid
  workflow_dispatch: # manual

permissions:
  contents: read
  issues: write

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm audit --audit-level=high
        continue-on-error: true
        id: audit
      - name: Create issue if vulnerabilities found
        if: steps.audit.outcome == 'failure'
        uses: actions/github-script@v7
        with:
          script: |
            const { data: issues } = await github.rest.issues.listForRepo({
              owner: context.repo.owner,
              repo: context.repo.repo,
              state: 'open',
              labels: ['security']
            });
            if (issues.length === 0) {
              await github.rest.issues.create({
                owner: context.repo.owner,
                repo: context.repo.repo,
                title: '🔒 High severity vulnerabilities found',
                body: '`pnpm audit` detectó vulnerabilidades high. Revisa y actualiza dependencias.',
                labels: ['security']
              });
            }