[daften]

Summary

#158 added audit-remediate.yml and the duplicate-heading fold in backmerge.yml to develop. Scheduled, workflow_run and push-to-main workflows run the version on main, so until these files are on main the nightly cannot trigger the remediation and the back-merge still runs the old step (no fold). This PR puts the CI files on main now instead of waiting for a release, following the precedent of earlier workflow-only fixes that went straight to main as manual hotfix PRs (#87, #133).

Merge as a merge commit, never squash or rebase. backmerge.yml then carries it into develop.

What is in it

Exactly the nine CI files of #158, byte for byte what is on develop (verified: git diff origin/develop HEAD -- .github scripts tests/automation is empty):

• .github/workflows/audit-remediate.yml (new), plus the edits to backmerge.yml and nightly.yml
• scripts/audit-remediate.mjs, scripts/changelog-fold-headings.mjs (new)
• their tests, the extended backmerge.node-test.mjs, and the real npm audit fixture

What is deliberately not in it

AGENTS.md and CHANGELOG.md edits from #158 stay on develop and ship with the next release (hence [skip changelog], as in #133). Putting them here as well would only risk a conflicting back-merge for no behavioural gain.

Verification

• On this branch (cut from main, with only these files added): 89 automation tests pass, npm run check passes (598 tests), the three workflow files parse.
• Simulated back-merge: this commit merged into develop with the real merge=union driver changes no content (empty diff), changelog-guard --baseline-ref passes, and the fold step is a no-op.
• Everything that was verified for ci: open a fix PR when the nightly audit fails; fold duplicate changelog headings in the back-merge #158 applies unchanged, since the files are identical: the fold reproduces the hand-made fix from the chore: back-merge main into develop (resolves #153) #154 back-merge byte for byte; the remediation steps, run against the lockfile main had before the hand-made hotfixes with the real registry, fixed all six packages and brought npm audit from 6 vulnerabilities to 0.

Not verified

• No real GitHub Actions run of audit-remediate.yml has happened yet (it cannot run until this is on main). After merging, run it once by hand from the Actions tab: a manual run is a dry run by default.
• The back-merge that follows this merge is the first real run of the fold step (it will find nothing to fold). The previous behaviour is unchanged when nothing needs folding, and a failure of the fold is a warning.
• gh pr create and the push with RELEASE_TOKEN from the new workflow are untested; backmerge.yml already does both with that token.

Type of change

• feat (new tool or feature)
• fix (bug fix)
• refactor (code cleanup, no behavior change)
• test (add or update tests)
• chore (dependencies, config, scaffolding)
• docs (documentation only)

Checklist

• Tests added or updated (promoted from ci: open a fix PR when the nightly audit fails; fold duplicate changelog headings in the back-merge #158)
• npm test passes locally (598 passed, 29 skipped); node --test tests/automation/*.node-test.mjs 89 passed
• npx tsc --noEmit passes locally
• README tool table updated (no tools changed)
• CLAUDE.md updated (AGENTS.md update ships with the next release)
• Verified against the Firefly III OpenAPI spec (not API-touching)

---

Generated by Claude Code

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	95.63%	1227 / 1283
🔵	Statements	95.28%	1393 / 1462
🔵	Functions	96.73%	355 / 367
🔵	Branches	93.07%	712 / 765

File Coverage

No changed files found.

Generated in workflow #374 for commit a748f85 by the Vitest Coverage Report Action