From 91777c798e658a615bb6ee2d99fb87cc8a2d5e1d Mon Sep 17 00:00:00 2001
From: Nick Schonning <nschonni@gmail.com>
Date: Wed, 11 Nov 2026 14:10:37 -0500
Subject: [PATCH] build: add "[security]" to the PR title when appropriate

---
 build-automation.mjs | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/build-automation.mjs b/build-automation.mjs
index cdc4c75e7..fd0bb306d 100644
--- a/build-automation.mjs
+++ b/build-automation.mjs
@@ -11,6 +11,8 @@ const nodeKeys = readFileSync(resolve(import.meta.dirname, 'keys', 'node.keys'))
 
 const updatedVersions = [];
 
+let isSecurity = true;
+
 try {
   console.log(
     `Found major versions in versions.json: ${Object.keys(supportedVersions).join(', ')}`,
@@ -127,6 +129,7 @@ try {
       } else if (latestVersion.version !== localVersion) {
         console.log(`\t${variant}: updating to ${latestVersion.version}`);
         updatedVersions.push(latestVersion.version);
+        isSecurity &= latestVersion.security;
         writeFileSync(dockerfilePath, dockerfileOutput);
       } else {
         console.warn(
@@ -139,7 +142,7 @@ try {
     // Let the GitHub Action library set the GITHUB_ENV file rather than manually handling it
     exportVariable(
       'NODE_PR_TITLE',
-      `feat: Node.js ${[...new Set(updatedVersions)].join(', ')}`,
+      `feat${isSecurity ? '[security]' : ''}: Node.js ${[...new Set(updatedVersions)].join(', ')}`,
     );
   } else {
     console.log('No Pull Request will be created.');