From a48c2bf4917888d549cd1ba8efe58f4c877228d9 Mon Sep 17 00:00:00 2001
From: Aaron Liang <76561968+AaronL725@users.noreply.github.com>
Date: Tue, 14 Jul 2026 21:25:25 +0800
Subject: [PATCH] chore: add temporary audit fix workflow

---
 .github/workflows/temp-audit-fixes.yml | 30 ++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 .github/workflows/temp-audit-fixes.yml

diff --git a/.github/workflows/temp-audit-fixes.yml b/.github/workflows/temp-audit-fixes.yml
new file mode 100644
index 0000000..08820ff
--- /dev/null
+++ b/.github/workflows/temp-audit-fixes.yml
@@ -0,0 +1,30 @@
+name: Temporary audit fixes
+
+on:
+  workflow_dispatch:
+  issues:
+    types: [edited]
+
+permissions:
+  contents: write
+
+jobs:
+  apply:
+    if: github.event_name == 'workflow_dispatch' || github.event.issue.number == 7
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Apply audit fixes
+        run: python tools/apply_audit_fixes.py
+      - name: Commit and cleanup
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git rm -f tools/apply_audit_fixes.py .github/workflows/temp-audit-fixes.yml
+          git add -A
+          if git diff --cached --quiet; then
+            echo "No changes to commit"
+          else
+            git commit -m "fix: harden token pools and CPA export"
+            git push
+          fi