Weekly Security Audit #26

	name: Weekly Security Audit

	on:
	schedule:
	# Run every Monday at 2:00 AM UTC
	- cron: '0 2 * * 1'
	# Allow manual triggering for testing
	workflow_dispatch:

	jobs:
	security-audit:
	runs-on: ubuntu-latest

	# Apply timeout to prevent hung jobs from consuming runner minutes
	timeout-minutes: 15

	steps:
	- name: Checkout code
	uses: actions/checkout@v2

	- name: Set up Node.js
	uses: actions/setup-node@v2
	with:
	node-version: '18'
	cache: 'npm'

	- name: Install dependencies
	run: npm ci

	- name: Run security audit
	run: npm audit --audit-level=high
	continue-on-error: true

	- name: Run tests
	run: npm test
	continue-on-error: true

	# Create issues for security vulnerabilities using GitHub's built-in features
	- name: Log security issues
	if: always()
	run: \|
	echo "Security audit completed. Check the workflow logs for details."
	if [ -f "npm-audit.json" ]; then
	echo "Security issues found. Creating a GitHub issue."
	# GitHub's recommended approach to create issues through Actions
	gh issue create --title "Security Audit Findings" --body "$(cat npm-audit.json)" --label "security"
	fi
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Provide feedback