name: Caterium One-Time NPM Lock Refresh
on:
  push:
    branches: ["fix/npm-security-v1774"]
permissions:
  contents: write
concurrency:
  group: caterium-npm-lock-refresh-v1774
  cancel-in-progress: false
jobs:
  refresh:
    if: ${{ !contains(github.event.head_commit.message, '[npm-lock-refresh]') }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: fix/npm-security-v1774
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: npm install --package-lock-only
      - run: npm audit --audit-level=high
      - name: Commit refreshed lockfile
        shell: bash
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          if git diff --quiet -- package-lock.json; then
            echo "No lockfile change required"
            exit 0
          fi
          git add package-lock.json
          git commit -m "security: refresh npm lockfile [npm-lock-refresh]"
          git push origin HEAD:fix/npm-security-v1774