From 2dde6aced589eced9f3ec50967736f580d829714 Mon Sep 17 00:00:00 2001
From: Brendan Kellam <brendan@sourcebot.dev>
Date: Mon, 10 Aug 2026 10:09:03 -0700
Subject: [PATCH] chore: enable nightly CVE remediation

---
 .github/workflows/cve-remediation.yml | 32 +++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 .github/workflows/cve-remediation.yml

diff --git a/.github/workflows/cve-remediation.yml b/.github/workflows/cve-remediation.yml
new file mode 100644
index 000000000..d2b041d7f
--- /dev/null
+++ b/.github/workflows/cve-remediation.yml
@@ -0,0 +1,32 @@
+name: Nightly CVE Remediation
+
+on:
+  schedule:
+    # 1:00am Pacific during daylight saving time.
+    - cron: '0 8 * * *'
+  workflow_dispatch:
+    inputs:
+      max_issues:
+        description: Maximum number of unlinked CVEs to process.
+        required: false
+        type: number
+        default: 50
+
+concurrency:
+  group: cve-remediation-${{ github.repository }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  pull-requests: write
+  id-token: write
+  actions: read
+
+jobs:
+  remediate:
+    uses: sourcebot-dev/sourcebot/.github/workflows/_cve-remediation.yml@main
+    with:
+      workflow_asset_repository: sourcebot-dev/sourcebot
+      workflow_asset_ref: main
+      max_issues: ${{ fromJSON(github.event.inputs.max_issues || '50') }}
+    secrets: inherit