21 lines (17 loc) · 740 Bytes

Daily Quarantine Automation

Workflow: .github/workflows/daily-security.yml

Sequence

npm run sync
npm run whitelist:verify
Find latest report in data/security-reports/*/report.json
npm run quarantine:apply -- --report <latest>
Open/update PR with whitelist and quarantine changes

Expected Outcome

Entries that now fail policy are removed from whitelist.
Failed entries are added to quarantine with reasons and timestamp.
Recommendations/install flow treats quarantined IDs as blocked.

Manual Re-approval

Remove or reduce offending signals.
Re-run verification locally.
Open PR to remove from data/quarantine/quarantined.json and add back to whitelist.
CODEOWNERS approval is required.