From 1fbe385682df2c77fc3106edb6daf985c472e96a Mon Sep 17 00:00:00 2001
From: jeo-ch <jeo-ch@users.noreply.github.com>
Date: Wed, 17 Jun 2026 05:35:15 +0000
Subject: [PATCH] feat(ci): add dependency updates, lock-threads, and sweep
 workflows

---
 .github/workflows/dependency-updates.yml | 71 ++++++++++++++++++++++++
 .github/workflows/lock-closed-issues.yml | 26 +++++++++
 .github/workflows/sweep.yml              | 42 ++++++++++++++
 3 files changed, 139 insertions(+)
 create mode 100644 .github/workflows/dependency-updates.yml
 create mode 100644 .github/workflows/lock-closed-issues.yml
 create mode 100644 .github/workflows/sweep.yml

diff --git a/.github/workflows/dependency-updates.yml b/.github/workflows/dependency-updates.yml
new file mode 100644
index 00000000..0857f837
--- /dev/null
+++ b/.github/workflows/dependency-updates.yml
@@ -0,0 +1,71 @@
+name: Dependency Updates
+
+on:
+  schedule:
+    - cron: '0 0 * * MON'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dependency-updates-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check-outdated:
+    name: check-outdated
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Check outdated packages (root)
+        run: bun outdated || true
+
+      - name: Install adapter dependencies
+        working-directory: adapters
+        run: bun install
+
+      - name: Check outdated packages (adapters)
+        working-directory: adapters
+        run: bun outdated || true
+
+  npm-audit:
+    name: npm-audit
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Run npm audit
+        run: npm audit --json > /tmp/audit-report.json || true
+
+      - name: Show audit summary
+        run: npm audit || true
+
+      - name: Fail on high severity vulnerabilities
+        run: |
+          HIGH=$(npm audit --audit-level=high 2>&1; echo "exit:$?")
+          echo "$HIGH"
diff --git a/.github/workflows/lock-closed-issues.yml b/.github/workflows/lock-closed-issues.yml
new file mode 100644
index 00000000..78205c42
--- /dev/null
+++ b/.github/workflows/lock-closed-issues.yml
@@ -0,0 +1,26 @@
+name: Lock Closed Issues
+
+on:
+  schedule:
+    - cron: '0 0 * * 0'
+  workflow_dispatch:
+
+permissions:
+  issues: write
+
+concurrency:
+  group: lock-closed-issues
+  cancel-in-progress: true
+
+jobs:
+  lock-closed-issues:
+    name: lock-closed-issues
+    runs-on: ubuntu-latest
+    steps:
+      - name: Lock closed issues
+        uses: dessant/lock-threads@v5
+        with:
+          github-token: ${{ github.token }}
+          issue-inactive-days: '30'
+          pr-inactive-days: '90'
+          process-only: 'issues, prs'
diff --git a/.github/workflows/sweep.yml b/.github/workflows/sweep.yml
new file mode 100644
index 00000000..4c5c70dc
--- /dev/null
+++ b/.github/workflows/sweep.yml
@@ -0,0 +1,42 @@
+name: Sweep
+
+on:
+  schedule:
+    - cron: '0 0 * * 1'
+  workflow_dispatch:
+
+permissions:
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: sweep
+  cancel-in-progress: true
+
+jobs:
+  sweep:
+    name: sweep
+    runs-on: ubuntu-latest
+    steps:
+      - name: Stale issues and PRs
+        uses: actions/stale@v9
+        with:
+          days-before-issue-stale: 60
+          days-before-issue-close: 7
+          stale-issue-label: stale
+          stale-issue-message: >
+            This issue is stale because it has been open for 60 days with no
+            activity. If this is still an issue, please add a comment with an
+            update. Otherwise this issue will be closed in 7 days.
+          close-issue-message: This issue was closed because it has been stalled for 7 days with no activity.
+          days-before-pr-stale: 45
+          days-before-pr-close: 10
+          stale-pr-label: stale
+          stale-pr-message: >
+            This pull request is stale because it has been open for 45 days with
+            no activity. If you are still working on this, please add a comment
+            with an update. Otherwise this pull request will be closed in 10 days.
+          close-pr-message: This pull request was closed because it has been stalled for 10 days with no activity.
+          operations-per-run: 100
+          exempt-all-milestones: true
+          exempt-all-assignees: true