ci: fix the nightly dependency-updates job, untrack outdated.json

Three bugs in one job.

1. `npm outdated --json` prints `{}` when nothing is outdated, and `{}`
   is 3 bytes, so `[ -s outdated.json ]` was always true and
   updates_available was effectively hardcoded to true.

2. The job wrote outdated.json into the working tree and then used
   `git status --porcelain` over the whole tree to decide changes_made,
   so its own scratch file influenced the answer.

3. Because create-pull-request had no add-paths, that scratch file got
   swept into the commit. outdated.json is tracked in git today and this
   workflow has committed it to main five times (#28, #29, #47, ...).

Scratch now goes to $RUNNER_TEMP, the {} case is handled, changes_made
is scoped to package.json and package-lock.json, and add-paths pins the
PR contents to those two files.

Also allow workflow_dispatch. Under `if: github.event_name ==
'schedule'` this job could not be tested without waiting for 2 AM UTC.

`npx --yes` because the log shows npm-check-updates being resolved via
an interactive install prompt, and the step is renamed to match what
`--target patch` actually does.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: soodoku

.github/workflows/security-and-updates.yml

@@ -88,7 +88,7 @@ jobs:
   dependency-updates:
     name: Update Dependencies
     runs-on: ubuntu-latest
-    if: github.event_name == 'schedule'
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
 
     steps:
       - name: Checkout code
@@ -105,27 +105,32 @@ jobs:
       - name: Check for updates
         id: updates
         run: |
-          npm outdated --json > outdated.json || true
-          if [ -s outdated.json ]; then
-            echo "updates_available=true" >> $GITHUB_OUTPUT
+          # Written to RUNNER_TEMP, not the repo, so it can never dirty
+          # git status or get swept into the PR.
+          npm outdated --json > "$RUNNER_TEMP/outdated.json" || true
+          # `npm outdated --json` prints {} when nothing is outdated, so a
+          # bare -s test is always true.
+          if [ -s "$RUNNER_TEMP/outdated.json" ] &&
+             [ "$(tr -d '[:space:]' < "$RUNNER_TEMP/outdated.json")" != '{}' ]; then
+            echo "updates_available=true" >> "$GITHUB_OUTPUT"
           else
-            echo "updates_available=false" >> $GITHUB_OUTPUT
+            echo "updates_available=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Update minor and patch versions
+      - name: Update patch versions
+        id: patch_updates
         if: steps.updates.outputs.updates_available == 'true'
         run: |
-          # Update patch versions (safe)
-          npx npm-check-updates -u --target patch
+          npx --yes npm-check-updates -u --target patch
           npm install
 
-          # Check if changes were made
-          if [ -n "$(git status --porcelain)" ]; then
-            echo "changes_made=true" >> $GITHUB_OUTPUT
+          # Scoped to the two manifests so changes_made reflects only what
+          # the PR would actually contain.
+          if [ -n "$(git status --porcelain -- package.json package-lock.json)" ]; then
+            echo "changes_made=true" >> "$GITHUB_OUTPUT"
           else
-            echo "changes_made=false" >> $GITHUB_OUTPUT
+            echo "changes_made=false" >> "$GITHUB_OUTPUT"
           fi
-        id: patch_updates
 
       - name: Run tests after updates
         if: steps.patch_updates.outputs.changes_made == 'true'
@@ -161,3 +166,7 @@ jobs:
             Please review the changes before merging.
           branch: 'automated/dependency-updates'
           delete-branch: true
+          # Hard guarantee the PR contains nothing but the manifests.
+          add-paths: |
+            package.json
+            package-lock.json

.gitignore

@@ -19,6 +19,9 @@
 .DS_Store
 *.pem
 
+# CI scratch output
+outdated.json
+
 # debug
 npm-debug.log*
 yarn-debug.log*