Include forks in the weekly dependency audit coverage check

.github/workflows/dependency-audit-coverage.yml

@@ -24,4 +24,4 @@ jobs:
       - name: Check public repositories
         env:
           GH_TOKEN: ${{ github.token }}
-        run: python3 scripts/sync-dependency-audit.py --check --org hraness --visibility public | tee -a "$GITHUB_STEP_SUMMARY"
+        run: python3 scripts/sync-dependency-audit.py --check --org hraness --visibility public --include-forks | tee -a "$GITHUB_STEP_SUMMARY"

AGENTS.md

@@ -22,7 +22,7 @@
 - `scripts/ci-cost-lint.py` checks a repository's workflows against the cost rules in the `hraness-ci` block; `.github/workflows/ci-cost-lint.yml` is the reusable workflow that runs it.
 - `scripts/actions-cost-report.py` summarizes the organization's GitHub billing usage per repository and SKU, the daily net trend, and budget headroom.
 - `actions/npm-visible/` checks public npm version, archive, tag, and provenance visibility within one deadline; its reference documents inputs, outputs, and failure behavior.
-- `actions/dependency-audit/` scans every lockfile in a repository with a pinned OSV-Scanner: pull requests fail only on vulnerabilities they add, and the daily run on `main` keeps one `dependency-audit` issue current. `scripts/sync-dependency-audit.py` checks or installs its workflow from `templates/dependency-audit.yml`, pinned to this repository's newest `vX.Y.Z` tag, in every repository that tracks a lockfile; `.github/workflows/dependency-audit-coverage.yml` runs the check weekly over public repositories, and private ones are checked from a signed-in machine with `--org hraness --visibility private`.
+- `actions/dependency-audit/` scans every lockfile in a repository with a pinned OSV-Scanner: pull requests fail only on vulnerabilities they add, and the daily run on `main` keeps one `dependency-audit` issue current. `scripts/sync-dependency-audit.py` checks or installs its workflow from `templates/dependency-audit.yml`, pinned to this repository's newest `vX.Y.Z` tag, in every repository that tracks a lockfile; `.github/workflows/dependency-audit-coverage.yml` runs the check weekly over public repositories, forks included, and private ones are checked from a signed-in machine with `--org hraness --visibility private`.
 - `BROWSER_AUTOMATION.md` describes browser provisioning, selection, cleanup, and regression evidence.
 - `scripts/register-browser-policy.py` checks or installs the browser rule in global agent files or selected repository roots, preserving other instructions. Global files cover local sessions; repository files and the Devin personal-cloud plugin make the rule portable.
 - `plugins/browser-automation/` is a rule-only Devin plugin for account-wide cloud, CLI, and Desktop registration; it carries the same canonical browser rule and no tools, hooks, MCP servers, or dependencies.

actions/dependency-audit/README.md

@@ -82,8 +82,8 @@ abbreviated commit are skipped.
 `scripts/sync-dependency-audit.py --check` reports, for each repository, whether
 the workflow is current, outdated, drifted, or missing, with its latest run on
 `main` and the open tracking issue. `.github/workflows/dependency-audit-coverage.yml`
-runs it weekly over public repositories. Check private repositories from a
-signed-in machine:
+runs it weekly over public repositories, forks included. Check private repositories
+from a signed-in machine:
 
 ```sh
 scripts/sync-dependency-audit.py --check --org hraness --visibility private