[jan-kubica]

Extend the dependency quarantine to all tracked Bun and Cargo lockfiles, pin both reusable workflows to the expanded validator revision, and explicitly deny Bun lifecycle scripts by default.

Summary by CodeRabbit

• Chores
  • Newly published Rust packages are subject to a five-day waiting period; no exceptions are currently listed.
  • Quarantine policy checks now also run when changes are pushed to the main branch.
  • Quarantine pruning now runs daily instead of hourly. The JavaScript package release waiting period remains unchanged.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: 6a654ce

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: stella/stdnum/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1c06a47c-c905-46c1-91b8-3bd989da3a19

📥 Commits

Reviewing files that changed from the base of the PR and between 28e6360 and 6a654ce.

📒 Files selected for processing: 2

• .github/workflows/quarantine-policy.yml
• .github/workflows/quarantine-prune.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout: 12

• GitHub Check: Test
• GitHub Check: Oracle
• GitHub Check: Bindings and packages
• GitHub Check: Lint
• GitHub Check: Version sync
• GitHub Check: Changeset
• GitHub Check: Pack
• GitHub Check: Rust
• GitHub Check: Enforce package quarantine / Enforce package quarantine
• GitHub Check: Check generated AI instructions
• GitHub Check: dependency-review
• GitHub Check: cla / cla

🔇 Additional comments: 3

.github/workflows/quarantine-policy.yml: 1

18-18: LGTM!

.github/workflows/quarantine-prune.yml: 2

5-5: LGTM!

16-16: LGTM!

📝 Walkthrough

The changes configure a five-day Cargo package age limit, add empty quarantine and trusted-dependency lists, and update quarantine workflow triggers, schedules and reusable workflow references. The Bun minimum release-age value remains unchanged.

Changes: Release-age policy

Layer / File(s)	Summary
Package selection settings .cargo/config.toml, .cargo/quarantine.toml, bunfig.toml, package.json	Cargo configuration sets a five-day global minimum publish age. The quarantine file adds an empty excludes list. Bun retains its 432000 minimum release age, with its numeric separator removed. package.json adds an empty trustedDependencies array.
Quarantine workflow configuration .github/workflows/quarantine-policy.yml, .github/workflows/quarantine-prune.yml	The policy workflow adds a push trigger for main. Both workflows update their reusable workflow references. The prune workflow schedule changes from hourly to daily at 04:11.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: 🔵 Low · up to 6a654

The five-day Cargo release-age guard is inactive, allowing dependency resolution to accept newly published crates immediately. The usual build workflows remain runnable, but merging leaves this bounded supply-chain safeguard unapplied.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly describes the main change: extending the shared package quarantine across the tracked dependency systems and workflows.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/quarantine-prune.yml

Package	Version	License	Issue Type
stella/.github/.github/workflows/quarantine-prune.yml	df2659b7ccaa9cb69e69a99787fd4e2180db5893	Null	Unknown License

Allowed Licenses:

MIT, Apache-2.0, Apache-2.0 WITH LLVM-exception, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD, BlueOak-1.0.0, Unlicense, CC0-1.0, CC-BY-4.0, MIT-0, MPL-2.0, Python-2.0, Zlib, Unicode-3.0

Excluded from license check:

pkg:cargo/libfuzzer-sys

OpenSSF Scorecard

Package	Version	Score	Details
actions/stella/.github/.github/workflows/quarantine-prune.yml	df2659b7ccaa9cb69e69a99787fd4e2180db5893	Unknown	Unknown

Scanned Files

• .github/workflows/quarantine-prune.yml