ci(DPA2-6761): add the weekday dependency audit

.github/actions/dependency-audit-agent/action.yaml

@@ -0,0 +1,80 @@
+name: Dependency audit fix agent
+description: |
+  Creates a Cursor cloud agent that fixes the CRITICAL and HIGH dependency findings found by the
+  weekday Trivy scan, and opens or updates the single fix pull request.
+
+  The agent is tagged with `cloud.metadata` (repository, use case, workflow, branches, runner and
+  run) so its spend can be joined to a repository in usage and billing exports, and the mechanical
+  bump-and-regenerate loop is delegated to a subagent pinned to DeepSeek Flash.
+
+  Findings reach the agent as environment variables because the scan runs on this runner while the
+  agent runs in its own VM. The verdict comes back in the agent's final message: a run that did not
+  finish, or that ends without a readable verdict, is treated as unresolved.
+
+  The clone, the push and the pull request all go through the Cursor GitHub App, which must be
+  installed on the target repository. No repository-write token is needed.
+
+  This action is consumed by `dependency-audit.yaml`. It exists as an action rather than as steps
+  in that workflow so a public or internal repository — which cannot call a private reusable
+  workflow — can still `uses:` it, keeping a single copy of the logic across every repository.
+
+inputs:
+  cursor-api-key:
+    description: Cursor API key that creates the cloud fix agent.
+    required: true
+  repository:
+    description: Target repository as `owner/name`.
+    required: true
+  repository-url:
+    description: Clone URL of the target repository.
+    required: true
+  base-branch:
+    description: Default branch that the agent branches from and that the fix pull request targets.
+    required: true
+  fix-branch:
+    description: Long-lived branch that carries the single fix pull request.
+    required: true
+  findings-critical-high:
+    description: JSON array of the CRITICAL and HIGH findings to fix, already filtered for accepted advisories.
+    required: true
+  findings-medium-low:
+    description: JSON array of the MEDIUM and LOW findings, listed in the pull request body but never fixed.
+    required: true
+  accepted-advisories:
+    description: JSON array of advisory ids the repository already accepts.
+    required: false
+    default: "[]"
+  toolchains:
+    description: Space-separated toolchains the repository uses, e.g. `node go rust`.
+    required: false
+    default: "unknown"
+  runner-label:
+    description: The runner pool the job is using, recorded in the agent metadata tag.
+    required: false
+    default: "unknown"
+  pull-request-existed-before:
+    description: >-
+      `true` when a fix pull request was already open before this run. When false, the body of the
+      newly opened pull request is set from the agent's description.
+    required: false
+    default: "false"
+  github-token:
+    description: >-
+      The job's own `GITHUB_TOKEN`, used only to set the body on a newly opened pull request. The
+      action does not push with it; the Cursor GitHub App owns the branch.
+    required: false
+    default: ""
+
+outputs:
+  unresolved-critical-high:
+    description: `true` when a CRITICAL or HIGH finding that is not excepted is still unresolved.
+  pull-request-url:
+    description: The fix pull request, when one was opened or already open.
+  agent-id:
+    description: The Cursor cloud agent id. Join this against usage and billing exports.
+  agent-status:
+    description: The terminal status of the agent run.
+
+runs:
+  using: node24
+  main: index.mjs