Join our community: https://t.me/+DOylgFv1jyJlNzM0
Why this matters
scripts/verify-security-setup.js checks for required security configuration but is only invoked via npm run verify-security locally; nothing in .github/workflows runs it, so a misconfiguration can merge without anyone noticing.
Acceptance criteria
Files to touch
scripts/verify-security-setup.js
.github/workflows/security.yml
Out of scope
Does not change what the script itself checks.
Why this matters
scripts/verify-security-setup.js checks for required security configuration but is only invoked via
npm run verify-securitylocally; nothing in .github/workflows runs it, so a misconfiguration can merge without anyone noticing.Acceptance criteria
npm run verify-securityon pull requestsFiles to touch
scripts/verify-security-setup.js.github/workflows/security.ymlOut of scope
Does not change what the script itself checks.