From c394b989afdf5dd125c64d139cb9fa4fd8a3eac7 Mon Sep 17 00:00:00 2001
From: "pulse-triage[bot]"
 <249995291+pulse-triage[bot]@users.noreply.github.com>
Date: Wed, 14 Oct 2026 18:29:20 +0100
Subject: [PATCH] Keep issue metadata tooling in existing dependency scans

Exact PR2888 smoke job 115991110826 exposes two coverage failures: the integrated .github/scripts npm lock was omitted from Dependabot and the weekly complete/production audit matrix. Include that existing module in both unchanged scan routes; retain all audit findings, review groups and immutable action pins.

Contract-Neutral: Scan coverage integration correction for an existing tooling module; no product runtime, dependencies, permission, audit threshold or release behavior changes.
Change-source: pulse-maintainer
---
 .github/dependabot.yml              | 1 +
 .github/workflows/security-scan.yml | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 009c2f00ec..e41dc22376 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -67,6 +67,7 @@ updates:
   - package-ecosystem: "npm"
     directories:
       - "/"
+      - "/.github/scripts"
       - "/frontend-modern"
       - "/internal/cloudcp/portal/frontend"
       - "/tests/integration"
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index c7862e486e..f1bfd17825 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -426,6 +426,8 @@ jobs:
         include:
           - name: root tooling
             directory: '.'
+          - name: issue metadata tooling
+            directory: '.github/scripts'
           - name: product frontend
             directory: 'frontend-modern'
           - name: account frontend