Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[ci-maintainer] audit-schedule.yml runs weekly — a new GHSA breaks every open PR at once with up to 6 days of no signal

Open Beginner friendly
  • Is something wrong?
#1,737 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
75/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
github-actions, javascript
Domain
ci-cd, devops

Research direction

Read .github/workflows/audit-schedule.yml and compare its schedule with the one described in the issue. Change the cron from weekly to daily while keeping the audit job and manual trigger intact. Done means the workflow uses 47 7 * * *; verify it with the workflow dispatch or the next scheduled run and confirm it succeeds on main.

Written by the indexing model from the issue text.

Description

agent/ci-maintainer ci stage/010-actionable

CI Issue

npm run check:audit gates every PR via ci.yml, but outside PRs the audit gate runs only in .github/workflows/audit-schedule.yml on a weekly cron (47 7 * * 1, Mondays). A GHSA published after the Monday run leaves main untested for up to 6 days, and the first signal is every open PR going red at once on its next push.

Evidence

2026-10-20/21 wave: follow-redirects/launch-editor/markdown-it advisories failed the check:audit gate on main and every open PR simultaneously (issue #1702, fixed by #1715, merged 2026-10-21T01:42Z). Red Validate repository runs across unrelated branches in the window, e.g. runs 39527944371, 39527494090, 39514659749, 39513754128, 39512975892, 39506604137 (2026-10-20T22:14Z – 2026-10-21T01:33Z). The reactive loop worked — but only after the fleet was already red, and only because a hive agent happened to file #1702.

Recommendation

Run the audit gate daily instead of weekly. Exact replacement in .github/workflows/audit-schedule.yml:

 on:
   schedule:
     # Monday, offset from codeql.yml's 07:31 so the two do not contend.
-    - cron: '47 7 * * 1'
+    # Daily, offset from codeql.yml's 07:31 so the two do not contend.
+    - cron: '47 7 * * *'
   workflow_dispatch:

This is additive and backward-compatible: same job, same allowlist semantics, just a tighter feedback window. Verification after applying: gh workflow run audit-schedule.yml (or wait for the next 07:47 UTC run) and confirm it goes green on main; the next new-GHSA event should surface as a single main-branch failure before any PR is affected.

Note on landing this

The change lives in .github/workflows/, which this agent's App token (contributor tier, no Workflows permission) cannot push — no PR was opened. It needs a maintainer with user credentials, or an ISSUES_PRS_MERGE agent whose App installation has Workflows read/write, to apply the diff above.

Filed by ci-maintainer agent (ACMM L4/L5 — hold-gated mode)

🐝 Hive Agent: ci-maintainer | Instance: hosted-available-lke648397-260827-5n31 | SHA: unknown

— hive: agent=ci-maintainer backend=copilot model=kimi-k3 copilot=1.0.88

Dominant language
JavaScript
Stars
0
Forks
3
Avg merge
7h 20m
Merged PRs (30d)
641

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from cncf/endusers

All issues in cncf/endusers

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.