Repository navigation

Add one-shot dependency cleanup validation #1

	name: One-shot dependency cleanup

	on:
	push:
	branches:
	- feat/agent-ready-cloudflare
	paths:
	- '.github/workflows/one-shot-dependency-cleanup.yml'

	permissions:
	contents: write

	jobs:
	cleanup:
	runs-on: ubuntu-latest
	timeout-minutes: 20
	steps:
	- name: Check out branch
	uses: actions/checkout@v6
	with:
	ref: feat/agent-ready-cloudflare

	- name: Set up Node.js
	uses: actions/setup-node@v6
	with:
	node-version: '22.23.1'
	package-manager-cache: false

	- name: Synchronize and install dependencies
	run: \|
	npm install --package-lock-only --ignore-scripts
	npm clean-install --ignore-scripts --progress=false

	- name: Run security regression tests
	run: npm test

	- name: Build Cloudflare Pages output
	run: npx @cloudflare/next-on-pages@1

	- name: Record dependency audits
	run: \|
	npm audit --omit=dev --json --package-lock-only > npm-audit-runtime.json \|\| true
	npm audit --json --package-lock-only > npm-audit-full.json \|\| true

	- name: Upload dependency audits
	uses: actions/upload-artifact@v4
	with:
	name: dependency-audits-after-cleanup
	path: \|
	npm-audit-runtime.json
	npm-audit-full.json
	if-no-files-found: error
	retention-days: 14

	- name: Commit synchronized lockfile
	run: \|
	git diff --check
	if git diff --quiet package-lock.json; then
	echo 'package-lock.json is already synchronized.'
	exit 0
	fi
	git config user.name 'github-actions[bot]'
	git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
	git add package-lock.json
	git commit -m 'Remove unused vulnerable build dependencies'
	git push origin HEAD:feat/agent-ready-cloudflare