SK-2869 automate dependency upgrades

[skyflow-bharti]

WHY

Dependency updates were tracked manually with no guardrails. Two problems:

1. No freshness policy — new versions were merged the day they shipped, with no time for the ecosystem to surface bugs or security issues.
2. No automation — developers had to remember to check for outdated packages and there was no recurring prompt to act.

---

GOAL

Introduce a 14-day cooling period policy and fully automate the monthly upgrade cycle, while keeping humans in control of the final merge decision.

---

Changes

scripts/check-deps.js (new)

Reads package.json, queries the npm registry for each dependency, and finds the latest stable version published ≥ 14 days ago.

• Read-only mode (node scripts/check-deps.js): prints a report and exits 1 if any package is outdated. No file changes.
• Apply mode (--apply): writes the bumped versions to package.json. Used by the monthly workflow.
• Risk classification on every upgrade:
  • 🔴 HIGH — major bump of a runtime dependency, or major bump of core toolchain (typescript, jest, eslint, react, @babel/core, etc.)
  • 🟡 MEDIUM — major bump of any other devDependency
  • 🟢 LOW — minor or patch bump
• Excluded versions (too recent) are shown alongside with their age so reviewers know something newer exists but is blocked by the cooling period.
• A HIGH risk guidance section at the bottom lists changelog links for anything flagged HIGH.

---

scripts/validate-deps.js (new)

PR gate. Checks every pinned version in package.json against its npm publish date.

• Exit 0 → all versions are ≥ 14 days old. PR can merge.
• Exit 1 → one or more versions violate the cooling period. Blocks the PR with a clear table showing which versions and how many days old they are.
• Configurable via COOLING_DAYS env var (default: 14).

---

.github/workflows/validate-deps.yml (new)

CI gate that runs validate-deps.js on every PR touching package.json against main or release/*.
Prevents any version younger than 14 days from reaching main.

---

.github/workflows/dependency-upgrade.yml (new)

Monthly workflow (1st of every month, 09:00 UTC) that runs the full upgrade cycle and opens a draft PR automatically. Also triggerable manually via workflow_dispatch.

Flow:

1. Install current deps (npm install --ignore-scripts)
2. Run check-deps.js --apply — bumps compliant versions in package.json, captures the report
3. If nothing changed → job completes silently, no PR opened
4. Run npm install to regenerate the lockfile
5. If npm install fails with ERESOLVE (peer dep conflict after a major bump) → continue-on-error: true keeps the job alive; conflict details are appended to the PR body with diagnosis and fix options
6. Opens a draft PR on branch chore/monthly-dep-upgrade containing:
   • Full upgrade report with risk levels
   • Peer dep conflict details if applicable
   • Merge checklist requiring HIGH-risk changelog review before converting draft → ready

---

What this does NOT do

• Does not auto-merge. All PRs are drafts; a human must review and convert to ready.
• Does not upgrade pre-release versions (alpha, beta, rc, canary, etc.).
• Does not bypass the 14-day gate — even versions bumped by the workflow are subject to validate-deps.yml on the resulting PR.

---

Testing locally

# Dry-run report (no file changes)
node scripts/check-deps.js

# Validate current package.json passes the gate
node scripts/validate-deps.js

[github-actions]

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

[github-actions]

Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging.