# Add to an existing trusted workflow after checkout and Node.js setup.
# Copy the reviewed packages/cli/bin/iidy.mjs to tools/iidy.mjs first.
- name: Review public dependency maintenance
  run: node tools/iidy.mjs scan package.json --fail-on none --json > maintenance.json
# --fail-on none reports findings without failing on maintenance verdicts.
# Exit 2 still fails this step when the check cannot run.
# This creates a shareable report: use only public dependency identities.