v1.22.70: backport codex rules 61-68 + CLAUDE.md #415

	name: Security Audit

	on:
	push:
	branches: [master]
	pull_request:
	branches: [master]
	schedule:
	# Run weekly security audit
	- cron: "0 2 * * 1" # Every Monday at 2 AM UTC

	jobs:
	security-audit:
	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version: "20.x"
	cache: "npm"

	- name: Install dependencies
	run: npm ci

	- name: Run security audit
	run: npm run security-audit

	- name: Run npm audit
	run: npm audit \|\| true

	- name: Check for vulnerabilities
	run: \|
	if [ $? -ne 0 ]; then
	echo "Security vulnerabilities found!"
	npm audit --json > audit-results.json \|\| true
	fi

	- name: Upload audit results
	if: failure()
	uses: actions/upload-artifact@v4
	with:
	name: security-audit-results
	path: audit-results.json

	dependency-check:
	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version: "20.x"
	cache: "npm"

	- name: Install dependencies
	run: npm ci

	- name: Check for outdated dependencies
	run: \|
	npm outdated --json > outdated.json \|\| true
	if [ -s outdated.json ]; then
	echo "Outdated dependencies found:"
	cat outdated.json
	else
	echo "All dependencies are up to date"
	fi

	- name: Check lockfile integrity
	run: \|
	if [ -f package-lock.json ]; then
	npm ci --dry-run
	else
	echo "Missing package-lock.json"
	exit 1
	fi

Provide feedback