feat(deps): automated Remediation Strategy for Trivy-Detected NPM vulnerabilities #5

	name: Trivy Security Remediation

	on:
	pull_request:
	schedule:
	- cron: '0 3 * * *'
	workflow_dispatch:

	permissions:
	contents: write
	pull-requests: write

	jobs:
	security-remediation:
	runs-on: ubuntu-latest

	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Setup Node
	uses: actions/setup-node@v4
	with:
	node-version: 22

	- name: Install dependencies
	run: npm ci --ignore-scripts

	# Install Trivy
	- name: Install Trivy
	uses: aquasecurity/setup-trivy@v0.2.0

	# Verify installation (optional but helpful)
	- name: Check Trivy version
	run: trivy --version

	- name: Run remediation workflow
	run: bash scripts/trivy-remediation.sh

	- name: Check for changes
	id: changes
	run: \|
	if [[ -n $(git status --porcelain) ]]; then
	echo "changed=true" >> $GITHUB_OUTPUT
	fi

	- name: Create Pull Request
	if: steps.changes.outputs.changed == 'true' && github.event_name != 'pull_request'
	uses: peter-evans/create-pull-request@v6
	with:
	branch: security/trivy-remediation
	base: master
	title: 'Automated Trivy vulnerability remediation'
	body: 'Automated fix for HIGH and CRITICAL vulnerabilities detected by Trivy.'

Provide feedback