[jan-kubica]

Extend dependency quarantine enforcement to the repository's Bun and Cargo lockfiles, pin the reusable workflows, and make install-script trust explicit.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: ff24079

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: stella/tooling/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: db7e595f-d7eb-49be-a498-29a462e99c8c

📥 Commits

Reviewing files that changed from the base of the PR and between 7636bdd and ff24079.

📒 Files selected for processing: 2

• .github/workflows/quarantine-policy.yml
• .github/workflows/quarantine-prune.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout: 8

• GitHub Check: Enforce package quarantine / Enforce package quarantine
• GitHub Check: Hawk compiler compatibility
• GitHub Check: rust-lints
• GitHub Check: Shared tooling checks
• GitHub Check: Changeset present for published package changes
• GitHub Check: Check generated AI instructions
• GitHub Check: Generated setup with PostgreSQL and Valkey
• GitHub Check: cla / cla

🔇 Additional comments: 3

.github/workflows/quarantine-policy.yml: 1

18-18: LGTM!

.github/workflows/quarantine-prune.yml: 2

5-5: LGTM!

16-16: LGTM!

📝 Walkthrough

The changes add a five-day minimum publish age for Cargo, document an empty quarantine exclusion list, and update quarantine workflow triggers, schedules, and reusable workflow references. Bun's minimum release age value remains numerically unchanged. The root package configuration adds an empty trustedDependencies array.

Changes: Dependency quarantine policy

Layer / File(s)	Summary
Quarantine settings .cargo/config.toml, .cargo/quarantine.toml, bunfig.toml, package.json	Cargo receives a five-day minimum publish age and an empty quarantine exclusion list. The root package configuration adds an empty trustedDependencies array. Bun's minimumReleaseAge value is unchanged.
Quarantine workflow updates .github/workflows/quarantine-policy.yml, .github/workflows/quarantine-prune.yml	The policy workflow adds pushes to main as a trigger. Both reusable workflow references change. The prune schedule changes to daily at 04:11 UTC.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Possibly related PRs

• stella/tooling#198: This PR changes cloud setup to run bun install --frozen-lockfile when bun.lock changes. That install reads the bunfig.toml and package.json files changed here.

Merge Risk: ⚪ Minimal · up to ff240

The existing Cargo update cooldown preserves the five-day delay, and the changed workflows remain enabled. No concrete merge-blocking behavior is established; the change appears ready after normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly summarises the main change: extending shared package quarantine controls.
Description check		The description directly relates to the changeset. It mentions Bun and Cargo quarantine enforcement, pinned reusable workflows, and explicit install-script trust.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}