Add workflow to update audit expiry

[GCHQ-Developer-530]

Summary

After this PR contribution, we will have a script that we can manually run to update the audit expiry dates. However, these sometimes catch us out. It would be good if we could have a workflow that runs daily and checks if npm run audit-expiry fails, and then if it does, run the new audit:update script.

💬 Description

List of actions the workflow should do:

• Run npm run audit-expiry
• Run npm run audit:update
• Commit those changes to chore(root)
• Create a PR to develop

💰 Use value

It would save developers a job that happens monthly.

🚨 Urgency (low, medium or high)

Low

Additional info

I've suggested running the workflow daily, but realistically if we keep adding a month to the date then the day won't actually change so we could just run it every 25th.

Looks like we can use schedule cron - https://jasonet.co/posts/scheduled-actions/

[evenstensberg]

Would be natural that the team does this PR, because you have CI permissions and are able to debug + implement faster.

[evenstensberg]

Suggested logic:

1. Add flag for JSON output support to check-audit-expiry.mjs as well as "no-fail" flag to it.
2. Add flag support in update-audit.mjs with specific expiry update
3. Run check-audit-expiry.mjs and pipe the outputted structure into update-audit.mjs.

[evenstensberg]

JSON.stringify(data, null, 2);

[evenstensberg]

Let me know if you want me to implement this if y'all are busy 😄

[GCHQ-Developer-530]

Hi @evenstensberg, thanks for your contribution. I think it might be best if the team has a look at this ticket first before implementing anything. We still need to put it through our triage and refinement process to decide when we want to do the work.

[GCHQ-Developer-299]

Suggested during triage that this automation might make us even more complacent about audit exceptions, and that we need to keep in mind fixing the audit failures too.

Alongside this work we'd need to have some sort of per-sprint/per-month audit checkin where we try to address some failures.

[evenstensberg]

Ok. Code is in #4207 so you have that for reference

[evenstensberg]

BTW @GCHQ-Developer-299 will you send swag to external contributors or what have you decided not to? Was told you were going to discuss this after v3 was released but haven’t heard anything about it in ~1 year.

[GCHQ-Developer-112]

Suggested during triage that this automation might make us even more complacent about audit exceptions, and that we need to keep in mind fixing the audit failures too.

Alongside this work we'd need to have some sort of per-sprint/per-month audit checkin where we try to address some failures.

The agreed way of addressing this is to have a recurring event in the calendar to check this and make note of this in our ways of working

[GCHQ-Developer-299]

@evenstensberg sorry for the delay in responding to your question about swag. We're not able to ship things to external contributors for budgetary and logistical reasons.