name: Weekly Maintenance
on:
  schedule:
    - cron: "0 8 * * 6"
  workflow_dispatch:

jobs:
  maintenance:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      issues: write
      pull-requests: write
      id-token: write
    steps:
      - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
        with:
          fetch-depth: 0

      - uses: anthropics/claude-code-action@v1.0.77
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
            
          prompt: |
            REPO: ${{ github.repository }}

            Perform weekly repository maintenance. IMPORTANT: Renovate is already configured
            to handle ALL dependency version updates (npm, Go modules, GitHub Actions).
            Do NOT create issues for outdated packages or pending version bumps — check first
            if Renovate's Dependency Dashboard (issue #3) or an open PR already tracks it.

            Focus only on these tasks:

            1. **Security vulnerabilities**: Run `npm audit --json` and report CVEs that CANNOT
               be fixed by simply updating a package version (e.g. abandoned packages with no fix).
               Skip vulnerabilities where `npm audit fix` or a Renovate PR would resolve them.

            2. **Stale open issues**: Review open issues older than 90 days. Summarize them and
               suggest if any should be closed (resolved, won't fix, duplicate).

            3. **TODO/FIXME comments**: Check recent commits (last 4 weeks) for TODO or FIXME
               comments that were added but not tracked in issues.

            4. **README drift**: Verify that the install command examples in README.md still work
               by checking the current release tag and URL patterns.

            Before creating ANY issue, search open issues and PRs to confirm it's not a duplicate.
            Create issues only for genuinely new, actionable findings.

          claude_args: |
            --allowedTools "Read,Bash(npm:*),Bash(gh issue:*),Bash(gh pr:*),Bash(git:*)"