# Put the dependency and license audit on a schedule

An audit that runs when somebody remembers, moved onto a schedule that opens work the day an advisory lands.

Category: Audits and budgets
Source: https://letsship.ai/use-cases/schedule-the-dependency-and-license-audit
Published: 2026-08-25

## Goal

Run the dependency and license audit on a schedule and route its findings to an owner.

## Acceptance criteria

- The audit runs on a schedule independent of pull requests
- Findings are routed to a named owner or rotation
- New advisories open a ticket automatically
- Known accepted findings are recorded with a reason and a review date

## What lands as proof

A scheduled run producing a routed, owned ticket, which is what turns an audit into work that happens.

## Prompt

Copy this to an agent to open the ticket:

```text
Create a Linear issue in my team and assign it to the SHIP agent.

Title: Schedule the dependency and license audit

Description: Run the dependency and license audit on a schedule and route its findings to an owner.

Acceptance criteria:
- The audit runs on a schedule independent of pull requests
- Findings are routed to a named owner or rotation
- New advisories open a ticket automatically
- Known accepted findings are recorded with a reason and a review date

Before you create the issue, check whether this repository audits dependencies on any schedule today and say so in the description.
```

## Questions

### What does the agent actually change?

The ticket is scoped to one outcome: run the dependency and license audit on a schedule and route its findings to an owner. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.

### How do I know the work is done?

The pull request carries the evidence, not only the diff. Here that means a scheduled run opens work the day an advisory lands, so a reviewer can confirm the result without reproducing the work locally.

### How much oversight does this need?

The run stops for the plan, and the review bar is raised afterwards so that smaller suggestions block the merge too, not only serious findings.