# Prerequisites: reviewed helper at tools/ci/upload-inventory.mjs,
# Node.js 22+, and a compatible bom.json committed on the default branch.
# This refreshes a selected inventory snapshot; it does not discover runtime images.
name: Weekly maintenance review
on:
  schedule:
    - cron: '0 6 * * 1' # Monday 06:00 UTC
  workflow_dispatch:
permissions:
  contents: read
jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
      - name: Refresh maintenance context
        env:
          IIDY_UPLOAD_TOKEN: ${{ secrets.IIDY_UPLOAD_TOKEN }}
          IIDY_SOURCE_ID: ${{ vars.IIDY_SOURCE_ID }}
        run: node tools/ci/upload-inventory.mjs bom.json
# Replace/reconfigure the source before its 30-day expiry.
# For production, retrieve the inventory for the deployed artifact digest
# using your existing registry workflow instead of a committed sample BOM.