feat(deps): automated Remediation Strategy for Trivy-Detected NPM vulnerabilities #8

	name: Trivy Security Remediation

	on:
	pull_request:
	schedule:
	- cron: '0 3 * * *'
	workflow_dispatch:

	permissions:
	contents: write
	pull-requests: write

	jobs:
	security-remediation:
	runs-on: ubuntu-latest

	steps:
	- name: Checkout repository
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Setup Node
	uses: actions/setup-node@v4
	with:
	node-version: 22

	- name: Install dependencies
	run: npm ci --ignore-scripts

	- name: Install Trivy
	uses: aquasecurity/setup-trivy@v0.2.0

	- name: Check Trivy version
	run: trivy --version

	- name: Run remediation workflow
	run: bash scripts/trivy-remediation.sh

	# Optional debug step (can remove later)
	- name: Debug git changes
	run: \|
	git status
	git diff

	- name: Check for changes
	id: changes
	run: \|
	if ! git diff --quiet; then
	echo "changed=true" >> $GITHUB_OUTPUT
	fi

	- name: Create Pull Request
	if: steps.changes.outputs.changed == 'true' && github.event_name != 'pull_request'
	uses: peter-evans/create-pull-request@v6
	with:
	branch: security/trivy-remediation
	base: master
	add-paths: \|
	package.json
	package-lock.json
	commit-message: 'fix(security): automated Trivy remediation'
	title: Automated Trivy vulnerability remediation
	body: Automated fix for HIGH and CRITICAL vulnerabilities detected by Trivy.

Provide feedback