Adopt coordinated Node maintenance and dependency push validation

.github/workflows/dependency-audit.yml

@@ -1,43 +1,43 @@
-name: Node dependency audit
+name: Node dependency maintenance
 
-"on":
+'on':
   schedule:
-    - cron: 0 2 * * 1
-    - cron: 0 2 1 */3 *
+  - cron: '0 2 * * 1'
+  - cron: '0 2 1 */3 *'
   workflow_dispatch:
     inputs:
       audit-kind:
         description: Security fixes only, or security plus routine upgrades for this run.
         type: choice
         default: security
         options:
-          - security
-          - upgrades
+        - security
+        - upgrades
+  push:
+    branches:
+    - main
+    paths:
+    - '**/pnpm-lock.yaml'
+    - '**/package-lock.json'
+    - '.github/node-maintenance.json'
 
 permissions:
   contents: read
 
 concurrency:
   group: dependency-audit
   cancel-in-progress: false
+  queue: max
 
 jobs:
-  audit:
-    permissions:
-      contents: read
-      issues: write
-    uses: hydra-ecosystem/github-actions/.github/workflows/node-audit.yml@v1
-    with:
-      audit-kind: ${{ inputs.audit-kind || 'auto' }}
-
-  pull-request:
-    needs: audit
+  maintenance:
     permissions:
       contents: write
       pull-requests: write
-    uses: hydra-ecosystem/github-actions/.github/workflows/node-publish.yml@v1
+      issues: write
+    uses: hydra-ecosystem/github-actions/.github/workflows/node-maintenance.yml@v1
     with:
-      validation-passed: ${{ needs.audit.outputs.validation_passed }}
+      audit-kind: ${{ inputs.audit-kind || 'auto' }}
       app-client-id: ${{ vars.NODE_AUDIT_APP_CLIENT_ID }}
     secrets:
       app-private-key: ${{ secrets.NODE_AUDIT_APP_PRIVATE_KEY }}

server/tests/unit/test_release_workflow_supply_chain.py

@@ -14,6 +14,7 @@ def _approved_reusable_workflow(reference: str, filename: str) -> bool:
     if filename == "dependency-audit.yml" and reference in {
         "hydra-ecosystem/github-actions/.github/workflows/node-audit.yml@v1",
         "hydra-ecosystem/github-actions/.github/workflows/node-publish.yml@v1",
+        "hydra-ecosystem/github-actions/.github/workflows/node-maintenance.yml@v1",
     }:
         return True
     return (
@@ -74,6 +75,26 @@ def test_actions_dependency_updates_are_configured() -> None:
 @pytest.mark.parametrize(
     "filename,reference,allowed",
     [
+        (
+            "dependency-audit.yml",
+            "hydra-ecosystem/github-actions/.github/workflows/node-maintenance.yml@v1",
+            True,
+        ),
+        (
+            "dependency-audit.yml",
+            "hydra-ecosystem/github-actions/.github/workflows/node-maintenance.yml@v2",
+            False,
+        ),
+        (
+            "dependency-audit.yml",
+            "other/actions/.github/workflows/node-maintenance.yml@v1",
+            False,
+        ),
+        (
+            "publish.yml",
+            "hydra-ecosystem/github-actions/.github/workflows/node-maintenance.yml@v1",
+            False,
+        ),
         (
             "dependency-audit.yml",
             "hydra-ecosystem/github-actions/.github/workflows/node-audit.yml@v1",

website/README.md

@@ -39,7 +39,7 @@ ten-day cooldown. The repository-root `.github/node-maintenance.json` points to
 policy; edit its overrides to change project policy, and keep caller cron entries
 in `.github/workflows/dependency-audit.yml` consistent with the resolved schedule.
 
-To run an audit sooner, open **Actions → Node dependency audit → Run workflow**
+To run an audit sooner, open **Actions → Node dependency maintenance → Run workflow**
 on `main` and select `security` or `upgrades`. The action validates dependency
 changes before opening or updating one maintenance PR. A toolchain or schedule
 mismatch fails preflight and opens or updates a configuration issue. The action