From f148ab9181efde3e05ea619e35980b6ed6cf4db9 Mon Sep 17 00:00:00 2001
From: Omry Yadan <omry@yadan.net>
Date: Wed, 21 Oct 2026 02:02:19 +0800
Subject: [PATCH 1/2] Adopt coordinated Node maintenance and dependency push
 validation

---
 .../+coordinated-node-maintenance.yaml        |  3 ++
 .github/workflows/dependency-audit.yml        | 36 +++++++++----------
 2 files changed, 21 insertions(+), 18 deletions(-)
 create mode 100644 .changes/unreleased/+coordinated-node-maintenance.yaml

diff --git a/.changes/unreleased/+coordinated-node-maintenance.yaml b/.changes/unreleased/+coordinated-node-maintenance.yaml
new file mode 100644
index 00000000..241ddf97
--- /dev/null
+++ b/.changes/unreleased/+coordinated-node-maintenance.yaml
@@ -0,0 +1,3 @@
+kind: Changed
+body: Separate security and routine dependency proposals and validate committed dependencies after matching lockfile or maintenance-configuration changes.
+time: 2026-10-21T02:00:00+08:00
diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml
index 2056c0f0..e69b48cf 100644
--- a/.github/workflows/dependency-audit.yml
+++ b/.github/workflows/dependency-audit.yml
@@ -1,9 +1,9 @@
-name: Node dependency audit
+name: Node dependency maintenance
 
-"on":
+'on':
   schedule:
-    - cron: 0 2 * * 1
-    - cron: 0 2 1 */3 *
+  - cron: '0 2 * * 1'
+  - cron: '0 2 1 */3 *'
   workflow_dispatch:
     inputs:
       audit-kind:
@@ -11,8 +11,15 @@ name: Node dependency audit
         type: choice
         default: security
         options:
-          - security
-          - upgrades
+        - security
+        - upgrades
+  push:
+    branches:
+    - main
+    paths:
+    - '**/pnpm-lock.yaml'
+    - '**/package-lock.json'
+    - '.github/node-maintenance.json'
 
 permissions:
   contents: read
@@ -20,24 +27,17 @@ permissions:
 concurrency:
   group: dependency-audit
   cancel-in-progress: false
+  queue: max
 
 jobs:
-  audit:
-    permissions:
-      contents: read
-      issues: write
-    uses: hydra-ecosystem/github-actions/.github/workflows/node-audit.yml@v1
-    with:
-      audit-kind: ${{ inputs.audit-kind || 'auto' }}
-
-  pull-request:
-    needs: audit
+  maintenance:
     permissions:
       contents: write
       pull-requests: write
-    uses: hydra-ecosystem/github-actions/.github/workflows/node-publish.yml@v1
+      issues: write
+    uses: hydra-ecosystem/github-actions/.github/workflows/node-maintenance.yml@v1
     with:
-      validation-passed: ${{ needs.audit.outputs.validation_passed }}
+      audit-kind: ${{ inputs.audit-kind || 'auto' }}
       app-client-id: ${{ vars.NODE_AUDIT_APP_CLIENT_ID }}
     secrets:
       app-private-key: ${{ secrets.NODE_AUDIT_APP_PRIVATE_KEY }}

From f492526605689e42ee5f955bd61dfa9f49c04fd0 Mon Sep 17 00:00:00 2001
From: Omry Yadan <omry@yadan.net>
Date: Wed, 21 Oct 2026 02:16:06 +0800
Subject: [PATCH 2/2] Keep maintainer instructions aligned with the Actions
 entry

---
 docs/MAINTAINING.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/MAINTAINING.md b/docs/MAINTAINING.md
index 8487d6b2..68b6de41 100644
--- a/docs/MAINTAINING.md
+++ b/docs/MAINTAINING.md
@@ -237,7 +237,7 @@ ten-day cooldown. The repository-root `.github/node-maintenance.json` points to
 policy; edit its overrides to change project policy, and keep caller cron entries
 in `.github/workflows/dependency-audit.yml` consistent with the resolved schedule.
 
-To run an audit sooner, open **Actions → Node dependency audit → Run workflow**
+To run an audit sooner, open **Actions → Node dependency maintenance → Run workflow**
 on `main` and select `security` or `upgrades`. The action validates dependency
 changes before opening or updating one maintenance PR. A toolchain or schedule
 mismatch fails preflight and opens or updates a configuration issue. The action