From 55920f0585ed8267cc50e09e35d9e91d4cbaad1c Mon Sep 17 00:00:00 2001
From: Omry Yadan <omry@yadan.net>
Date: Wed, 21 Oct 2026 02:02:05 +0800
Subject: [PATCH 1/2] Adopt coordinated Node maintenance and dependency push
 validation

---
 .github/workflows/dependency-audit.yml        | 36 +++++++++----------
 .../test_release_workflow_supply_chain.py     | 21 +++++++++++
 2 files changed, 39 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml
index 2056c0f..e69b48c 100644
--- a/.github/workflows/dependency-audit.yml
+++ b/.github/workflows/dependency-audit.yml
@@ -1,9 +1,9 @@
-name: Node dependency audit
+name: Node dependency maintenance
 
-"on":
+'on':
   schedule:
-    - cron: 0 2 * * 1
-    - cron: 0 2 1 */3 *
+  - cron: '0 2 * * 1'
+  - cron: '0 2 1 */3 *'
   workflow_dispatch:
     inputs:
       audit-kind:
@@ -11,8 +11,15 @@ name: Node dependency audit
         type: choice
         default: security
         options:
-          - security
-          - upgrades
+        - security
+        - upgrades
+  push:
+    branches:
+    - main
+    paths:
+    - '**/pnpm-lock.yaml'
+    - '**/package-lock.json'
+    - '.github/node-maintenance.json'
 
 permissions:
   contents: read
@@ -20,24 +27,17 @@ permissions:
 concurrency:
   group: dependency-audit
   cancel-in-progress: false
+  queue: max
 
 jobs:
-  audit:
-    permissions:
-      contents: read
-      issues: write
-    uses: hydra-ecosystem/github-actions/.github/workflows/node-audit.yml@v1
-    with:
-      audit-kind: ${{ inputs.audit-kind || 'auto' }}
-
-  pull-request:
-    needs: audit
+  maintenance:
     permissions:
       contents: write
       pull-requests: write
-    uses: hydra-ecosystem/github-actions/.github/workflows/node-publish.yml@v1
+      issues: write
+    uses: hydra-ecosystem/github-actions/.github/workflows/node-maintenance.yml@v1
     with:
-      validation-passed: ${{ needs.audit.outputs.validation_passed }}
+      audit-kind: ${{ inputs.audit-kind || 'auto' }}
       app-client-id: ${{ vars.NODE_AUDIT_APP_CLIENT_ID }}
     secrets:
       app-private-key: ${{ secrets.NODE_AUDIT_APP_PRIVATE_KEY }}
diff --git a/server/tests/unit/test_release_workflow_supply_chain.py b/server/tests/unit/test_release_workflow_supply_chain.py
index c80b21a..35dd8fe 100644
--- a/server/tests/unit/test_release_workflow_supply_chain.py
+++ b/server/tests/unit/test_release_workflow_supply_chain.py
@@ -14,6 +14,7 @@ def _approved_reusable_workflow(reference: str, filename: str) -> bool:
     if filename == "dependency-audit.yml" and reference in {
         "hydra-ecosystem/github-actions/.github/workflows/node-audit.yml@v1",
         "hydra-ecosystem/github-actions/.github/workflows/node-publish.yml@v1",
+        "hydra-ecosystem/github-actions/.github/workflows/node-maintenance.yml@v1",
     }:
         return True
     return (
@@ -74,6 +75,26 @@ def test_actions_dependency_updates_are_configured() -> None:
 @pytest.mark.parametrize(
     "filename,reference,allowed",
     [
+        (
+            "dependency-audit.yml",
+            "hydra-ecosystem/github-actions/.github/workflows/node-maintenance.yml@v1",
+            True,
+        ),
+        (
+            "dependency-audit.yml",
+            "hydra-ecosystem/github-actions/.github/workflows/node-maintenance.yml@v2",
+            False,
+        ),
+        (
+            "dependency-audit.yml",
+            "other/actions/.github/workflows/node-maintenance.yml@v1",
+            False,
+        ),
+        (
+            "publish.yml",
+            "hydra-ecosystem/github-actions/.github/workflows/node-maintenance.yml@v1",
+            False,
+        ),
         (
             "dependency-audit.yml",
             "hydra-ecosystem/github-actions/.github/workflows/node-audit.yml@v1",

From 5253cbffd92ca63870d32380b9adcc5c38e87e8f Mon Sep 17 00:00:00 2001
From: Omry Yadan <omry@yadan.net>
Date: Wed, 21 Oct 2026 02:16:06 +0800
Subject: [PATCH 2/2] Keep maintainer instructions aligned with the Actions
 entry

---
 website/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/website/README.md b/website/README.md
index decbaed..22db896 100644
--- a/website/README.md
+++ b/website/README.md
@@ -39,7 +39,7 @@ ten-day cooldown. The repository-root `.github/node-maintenance.json` points to
 policy; edit its overrides to change project policy, and keep caller cron entries
 in `.github/workflows/dependency-audit.yml` consistent with the resolved schedule.
 
-To run an audit sooner, open **Actions → Node dependency audit → Run workflow**
+To run an audit sooner, open **Actions → Node dependency maintenance → Run workflow**
 on `main` and select `security` or `upgrades`. The action validates dependency
 changes before opening or updating one maintenance PR. A toolchain or schedule
 mismatch fails preflight and opens or updates a configuration issue. The action