fix(security): harden npm supply chain defaults and add Dependabot cooldown

[joshjohanning]

Hardens npm supply chain security across workflows, templates, and Dependabot configs.

Changes

npm hardening

• Add --ignore-scripts and --allow-git=none flags to all npm install / npm ci commands in workflow templates and this repo's own workflows
• Create .npmrc config (both repo-local and template for syncing) with:
  • ignore-scripts=true - prevents post-install script execution from untrusted packages
  • allow-git=none - blocks git-hosted dependency resolution
  • min-release-age=3 - only install npm packages published at least 3 days ago
• Update Copilot instructions to reference the hardened npm install flags

Dependabot cooldown

• Add cooldown: default-days: 3 to all package-ecosystem entries across all Dependabot config templates - delays version update PRs for newly released versions, giving time for compromised releases to be caught and reverted

Housekeeping

• Add node_modules to .gitignore
• Minor trailing whitespace cleanup in find-actions-repos.yml

Context

These changes are motivated by recent supply chain attacks targeting npm packages (e.g., compromised maintainer accounts publishing malicious versions). The cooldown period and min-release-age work together to avoid pulling in packages immediately after release, when they're most likely to be malicious and least likely to have been flagged.

Note: .npmrc file syncing is not supported in the action yet - just setting the stage here with ./config/npmrc/.npmrc. The .npmrc in the repo root is applied to this repo's own workflows (e.g., npm install js-yaml in find-actions-repos.yml).

[github-actions]

✅ Repository settings sync result (Dry-run preview)

• Processed repositories: 23
• Repositories with changes: 20
• Repositories without changes: 3
• Repositories with failures: 0

Changes were detected in this preview.

View workflow run

Per-repository results JSON

[
  {
    "repository": "joshjohanning/approveops",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "approveops",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentTopics": [
      "issueops",
      "issue-ops",
      "approval",
      "actions",
      "github",
      "javascript",
      "node-action"
    ],
    "topicsUnchanged": true,
    "topics": [
      "github",
      "actions",
      "javascript",
      "node-action",
      "approval",
      "issueops",
      "issue-ops"
    ],
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentImmutableReleases": true,
    "immutableReleasesUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true,
    "dependabotSync": {
      "repository": "joshjohanning/approveops",
      "success": true,
      "dependabotYml": "would-update",
      "message": "Would update .github/dependabot.yml via PR",
      "filesWouldUpdate": [
        ".github/dependabot.yml"
      ],
      "filesProcessed": [
        ".github/dependabot.yml"
      ],
      "dryRun": true
    },
    "gitignoreSync": {
      "repository": "joshjohanning/approveops",
      "success": true,
      "gitignore": "unchanged",
      "message": ".gitignore is already up to date",
      "filesProcessed": [
        ".gitignore"
      ],
      "dryRun": true
    },
    "rulesetSync": {
      "repository": "joshjohanning/approveops",
      "success": true,
      "ruleset": "unchanged",
      "rulesetId": 8700927,
      "message": "Ruleset \"ci\" is already up to date",
      "dryRun": true
    },
    "workflowFilesSync": {
      "repository": "joshjohanning/approveops",
      "success": true,
      "workflowFiles": "would-update",
      "message": "Would sync 1 file(s) via PR",
      "filesWouldUpdate": [
        ".github/workflows/ci.yml"
      ],
      "filesProcessed": [
        ".github/workflows/ci.yml",
        ".github/workflows/publish.yml"
      ],
      "dryRun": true
    },
    "copilotInstructionsSync": {
      "repository": "joshjohanning/approveops",
      "success": true,
      "copilotInstructions": "would-update",
      "message": "Would update .github/copilot-instructions.md via PR",
      "filesWouldUpdate": [
        ".github/copilot-instructions.md"
      ],
      "filesProcessed": [
        ".github/copilot-instructions.md"
      ],
      "dryRun": true
    },
    "packageJsonSync": {
      "repository": "joshjohanning/approveops",
      "success": true,
      "packageJson": "unchanged",
      "message": "package.json is already up to date",
      "dryRun": true
    }
  },
  {
    "repository": "joshjohanning/bulk-github-repo-settings-sync-action",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "bulk-github-repo-settings-sync-action",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentTopics": [
      "actions",
      "github",
      "javascript",
      "node-action"
    ],
    "topicsUnchanged": true,
    "topics": [
      "github",
      "actions",
      "javascript",
      "node-action"
    ],
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentImmutableReleases": true,
    "immutableReleasesUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true,
    "dependabotSync": {
      "repository": "joshjohanning/bulk-github-repo-settings-sync-action",
      "success": true,
      "dependabotYml": "would-update",
      "message": "Would update .github/dependabot.yml via PR",
      "filesWouldUpdate": [
        ".github/dependabot.yml"
      ],
      "filesProcessed": [
        ".github/dependabot.yml"
      ],
      "dryRun": true
    },
    "gitignoreSync": {
      "repository": "joshjohanning/bulk-github-repo-settings-sync-action",
      "success": true,
      "gitignore": "unchanged",
      "message": ".gitignore is already up to date",
      "filesProcessed": [
        ".gitignore"
      ],
      "dryRun": true
    },
    "rulesetSync": {
      "repository": "joshjohanning/bulk-github-repo-settings-sync-action",
      "success": true,
      "ruleset": "unchanged",
      "rulesetId": 8998061,
      "message": "Ruleset \"ci\" is already up to date",
      "dryRun": true
    },
    "workflowFilesSync": {
      "repository": "joshjohanning/bulk-github-repo-settings-sync-action",
      "success": true,
      "workflowFiles": "would-update",
      "message": "Would sync 1 file(s) via PR",
      "filesWouldUpdate": [
        ".github/workflows/ci.yml"
      ],
      "filesProcessed": [
        ".github/workflows/ci.yml",
        ".github/workflows/publish.yml"
      ],
      "dryRun": true
    },
    "copilotInstructionsSync": {
      "repository": "joshjohanning/bulk-github-repo-settings-sync-action",
      "success": true,
      "copilotInstructions": "would-update",
      "message": "Would update .github/copilot-instructions.md via PR",
      "filesWouldUpdate": [
        ".github/copilot-instructions.md"
      ],
      "filesProcessed": [
        ".github/copilot-instructions.md"
      ],
      "dryRun": true
    },
    "packageJsonSync": {
      "repository": "joshjohanning/bulk-github-repo-settings-sync-action",
      "success": true,
      "packageJson": "unchanged",
      "message": "package.json is already up to date",
      "dryRun": true
    }
  },
  {
    "repository": "joshjohanning/bulk-github-repo-sync-action",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "bulk-github-repo-sync-action",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentTopics": [
      "actions",
      "github",
      "javascript",
      "node-action"
    ],
    "topicsUnchanged": true,
    "topics": [
      "github",
      "actions",
      "javascript",
      "node-action"
    ],
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentImmutableReleases": true,
    "immutableReleasesUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true,
    "dependabotSync": {
      "repository": "joshjohanning/bulk-github-repo-sync-action",
      "success": true,
      "dependabotYml": "would-update",
      "message": "Would update .github/dependabot.yml via PR",
      "filesWouldUpdate": [
        ".github/dependabot.yml"
      ],
      "filesProcessed": [
        ".github/dependabot.yml"
      ],
      "dryRun": true
    },
    "gitignoreSync": {
      "repository": "joshjohanning/bulk-github-repo-sync-action",
      "success": true,
      "gitignore": "unchanged",
      "message": ".gitignore is already up to date",
      "filesProcessed": [
        ".gitignore"
      ],
      "dryRun": true
    },
    "rulesetSync": {
      "repository": "joshjohanning/bulk-github-repo-sync-action",
      "success": true,
      "ruleset": "unchanged",
      "rulesetId": 8672734,
      "message": "Ruleset \"ci\" is already up to date",
      "dryRun": true
    },
    "workflowFilesSync": {
      "repository": "joshjohanning/bulk-github-repo-sync-action",
      "success": true,
      "workflowFiles": "would-update",
      "message": "Would sync 1 file(s) via PR",
      "filesWouldUpdate": [
        ".github/workflows/ci.yml"
      ],
      "filesProcessed": [
        ".github/workflows/ci.yml",
        ".github/workflows/publish.yml"
      ],
      "dryRun": true
    },
    "copilotInstructionsSync": {
      "repository": "joshjohanning/bulk-github-repo-sync-action",
      "success": true,
      "copilotInstructions": "would-update",
      "message": "Would update .github/copilot-instructions.md via PR",
      "filesWouldUpdate": [
        ".github/copilot-instructions.md"
      ],
      "filesProcessed": [
        ".github/copilot-instructions.md"
      ],
      "dryRun": true
    },
    "packageJsonSync": {
      "repository": "joshjohanning/bulk-github-repo-sync-action",
      "success": true,
      "packageJson": "unchanged",
      "message": "package.json is already up to date",
      "dryRun": true
    }
  },
  {
    "repository": "joshjohanning/nodejs-actions-starter-template",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "nodejs-actions-starter-template",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentTopics": [
      "actions",
      "github",
      "javascript",
      "node-action"
    ],
    "topicsUnchanged": true,
    "topics": [
      "github",
      "actions",
      "javascript",
      "node-action"
    ],
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentImmutableReleases": true,
    "immutableReleasesUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true,
    "dependabotSync": {
      "repository": "joshjohanning/nodejs-actions-starter-template",
      "success": true,
      "dependabotYml": "would-update",
      "message": "Would update .github/dependabot.yml via PR",
      "filesWouldUpdate": [
        ".github/dependabot.yml"
      ],
      "filesProcessed": [
        ".github/dependabot.yml"
      ],
      "dryRun": true
    },
    "gitignoreSync": {
      "repository": "joshjohanning/nodejs-actions-starter-template",
      "success": true,
      "gitignore": "unchanged",
      "message": ".gitignore is already up to date",
      "filesProcessed": [
        ".gitignore"
      ],
      "dryRun": true
    },
    "rulesetSync": {
      "repository": "joshjohanning/nodejs-actions-starter-template",
      "success": true,
      "ruleset": "unchanged",
      "rulesetId": 9642045,
      "message": "Ruleset \"ci\" is already up to date",
      "dryRun": true
    },
    "workflowFilesSync": {
      "repository": "joshjohanning/nodejs-actions-starter-template",
      "success": true,
      "workflowFiles": "would-update",
      "message": "Would sync 1 file(s) via PR",
      "filesWouldUpdate": [
        ".github/workflows/ci.yml"
      ],
      "filesProcessed": [
        ".github/workflows/ci.yml",
        ".github/workflows/publish.yml"
      ],
      "dryRun": true
    },
    "copilotInstructionsSync": {
      "repository": "joshjohanning/nodejs-actions-starter-template",
      "success": true,
      "copilotInstructions": "would-update",
      "message": "Would update .github/copilot-instructions.md via PR",
      "filesWouldUpdate": [
        ".github/copilot-instructions.md"
      ],
      "filesProcessed": [
        ".github/copilot-instructions.md"
      ],
      "dryRun": true
    },
    "packageJsonSync": {
      "repository": "joshjohanning/nodejs-actions-starter-template",
      "success": true,
      "packageJson": "unchanged",
      "message": "package.json is already up to date",
      "dryRun": true
    }
  },
  {
    "repository": "joshjohanning/npm-version-check-action",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "npm-version-check-action",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentTopics": [
      "actions",
      "github",
      "javascript",
      "node-action"
    ],
    "topicsUnchanged": true,
    "topics": [
      "github",
      "actions",
      "javascript",
      "node-action"
    ],
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentImmutableReleases": true,
    "immutableReleasesUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true,
    "dependabotSync": {
      "repository": "joshjohanning/npm-version-check-action",
      "success": true,
      "dependabotYml": "would-update",
      "message": "Would update .github/dependabot.yml via PR",
      "filesWouldUpdate": [
        ".github/dependabot.yml"
      ],
      "filesProcessed": [
        ".github/dependabot.yml"
      ],
      "dryRun": true
    },
    "gitignoreSync": {
      "repository": "joshjohanning/npm-version-check-action",
      "success": true,
      "gitignore": "unchanged",
      "message": ".gitignore is already up to date",
      "filesProcessed": [
        ".gitignore"
      ],
      "dryRun": true
    },
    "rulesetSync": {
      "repository": "joshjohanning/npm-version-check-action",
      "success": true,
      "ruleset": "unchanged",
      "rulesetId": 11145315,
      "message": "Ruleset \"ci\" is already up to date",
      "dryRun": true
    },
    "workflowFilesSync": {
      "repository": "joshjohanning/npm-version-check-action",
      "success": true,
      "workflowFiles": "would-update",
      "message": "Would sync 1 file(s) via PR",
      "filesWouldUpdate": [
        ".github/workflows/ci.yml"
      ],
      "filesProcessed": [
        ".github/workflows/ci.yml",
        ".github/workflows/publish.yml"
      ],
      "dryRun": true
    },
    "copilotInstructionsSync": {
      "repository": "joshjohanning/npm-version-check-action",
      "success": true,
      "copilotInstructions": "would-update",
      "message": "Would update .github/copilot-instructions.md via PR",
      "filesWouldUpdate": [
        ".github/copilot-instructions.md"
      ],
      "filesProcessed": [
        ".github/copilot-instructions.md"
      ],
      "dryRun": true
    },
    "packageJsonSync": {
      "repository": "joshjohanning/npm-version-check-action",
      "success": true,
      "packageJson": "unchanged",
      "message": "package.json is already up to date",
      "dryRun": true
    }
  },
  {
    "repository": "joshjohanning/organization-readme-badge-generator",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "organization-readme-badge-generator",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentTopics": [
      "actions",
      "github",
      "org-readme",
      "javascript",
      "node-action"
    ],
    "topicsUnchanged": true,
    "topics": [
      "github",
      "actions",
      "javascript",
      "node-action",
      "org-readme"
    ],
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentImmutableReleases": true,
    "immutableReleasesUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true,
    "dependabotSync": {
      "repository": "joshjohanning/organization-readme-badge-generator",
      "success": true,
      "dependabotYml": "would-update",
      "message": "Would update .github/dependabot.yml via PR",
      "filesWouldUpdate": [
        ".github/dependabot.yml"
      ],
      "filesProcessed": [
        ".github/dependabot.yml"
      ],
      "dryRun": true
    },
    "gitignoreSync": {
      "repository": "joshjohanning/organization-readme-badge-generator",
      "success": true,
      "gitignore": "unchanged",
      "message": ".gitignore is already up to date",
      "filesProcessed": [
        ".gitignore"
      ],
      "dryRun": true
    },
    "rulesetSync": {
      "repository": "joshjohanning/organization-readme-badge-generator",
      "success": true,
      "ruleset": "unchanged",
      "rulesetId": 8991308,
      "message": "Ruleset \"ci\" is already up to date",
      "dryRun": true
    },
    "workflowFilesSync": {
      "repository": "joshjohanning/organization-readme-badge-generator",
      "success": true,
      "workflowFiles": "would-update",
      "message": "Would sync 1 file(s) via PR",
      "filesWouldUpdate": [
        ".github/workflows/ci.yml"
      ],
      "filesProcessed": [
        ".github/workflows/ci.yml",
        ".github/workflows/publish.yml"
      ],
      "dryRun": true
    },
    "copilotInstructionsSync": {
      "repository": "joshjohanning/organization-readme-badge-generator",
      "success": true,
      "copilotInstructions": "would-update",
      "message": "Would update .github/copilot-instructions.md via PR",
      "filesWouldUpdate": [
        ".github/copilot-instructions.md"
      ],
      "filesProcessed": [
        ".github/copilot-instructions.md"
      ],
      "dryRun": true
    },
    "packageJsonSync": {
      "repository": "joshjohanning/organization-readme-badge-generator",
      "success": true,
      "packageJson": "unchanged",
      "message": "package.json is already up to date",
      "dryRun": true
    }
  },
  {
    "repository": "joshjohanning/twistlock-results-json-to-markdown-action",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "twistlock-results-json-to-markdown-action",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentTopics": [
      "actions",
      "github",
      "prisma",
      "twistlock",
      "javascript",
      "node-action"
    ],
    "topicsUnchanged": true,
    "topics": [
      "github",
      "actions",
      "javascript",
      "node-action",
      "prisma",
      "twistlock"
    ],
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentImmutableReleases": true,
    "immutableReleasesUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true,
    "dependabotSync": {
      "repository": "joshjohanning/twistlock-results-json-to-markdown-action",
      "success": true,
      "dependabotYml": "would-update",
      "message": "Would update .github/dependabot.yml via PR",
      "filesWouldUpdate": [
        ".github/dependabot.yml"
      ],
      "filesProcessed": [
        ".github/dependabot.yml"
      ],
      "dryRun": true
    },
    "gitignoreSync": {
      "repository": "joshjohanning/twistlock-results-json-to-markdown-action",
      "success": true,
      "gitignore": "unchanged",
      "message": ".gitignore is already up to date",
      "filesProcessed": [
        ".gitignore"
      ],
      "dryRun": true
    },
    "rulesetSync": {
      "repository": "joshjohanning/twistlock-results-json-to-markdown-action",
      "success": true,
      "ruleset": "unchanged",
      "rulesetId": 9642047,
      "message": "Ruleset \"ci\" is already up to date",
      "dryRun": true
    },
    "workflowFilesSync": {
      "repository": "joshjohanning/twistlock-results-json-to-markdown-action",
      "success": true,
      "workflowFiles": "would-update",
      "message": "Would sync 1 file(s) via PR",
      "filesWouldUpdate": [
        ".github/workflows/ci.yml"
      ],
      "filesProcessed": [
        ".github/workflows/ci.yml",
        ".github/workflows/publish.yml"
      ],
      "dryRun": true
    },
    "copilotInstructionsSync": {
      "repository": "joshjohanning/twistlock-results-json-to-markdown-action",
      "success": true,
      "copilotInstructions": "would-update",
      "message": "Would update .github/copilot-instructions.md via PR",
      "filesWouldUpdate": [
        ".github/copilot-instructions.md"
      ],
      "filesProcessed": [
        ".github/copilot-instructions.md"
      ],
      "dryRun": true
    },
    "packageJsonSync": {
      "repository": "joshjohanning/twistlock-results-json-to-markdown-action",
      "success": true,
      "packageJson": "unchanged",
      "message": "package.json is already up to date",
      "dryRun": true
    }
  },
  {
    "repository": "joshjohanning/publish-github-action",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "publish-github-action",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentTopics": [
      "actions",
      "github",
      "node-action",
      "javascript"
    ],
    "topicsUnchanged": true,
    "topics": [
      "github",
      "actions",
      "javascript",
      "node-action"
    ],
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentImmutableReleases": true,
    "immutableReleasesUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true,
    "dependabotSync": {
      "repository": "joshjohanning/publish-github-action",
      "success": true,
      "dependabotYml": "would-update",
      "message": "Would update .github/dependabot.yml via PR",
      "filesWouldUpdate": [
        ".github/dependabot.yml"
      ],
      "filesProcessed": [
        ".github/dependabot.yml"
      ],
      "dryRun": true
    },
    "gitignoreSync": {
      "repository": "joshjohanning/publish-github-action",
      "success": true,
      "gitignore": "unchanged",
      "message": ".gitignore is already up to date",
      "filesProcessed": [
        ".gitignore"
      ],
      "dryRun": true
    },
    "rulesetSync": {
      "repository": "joshjohanning/publish-github-action",
      "success": true,
      "ruleset": "unchanged",
      "rulesetId": 8998322,
      "message": "Ruleset \"ci\" is already up to date",
      "dryRun": true
    },
    "workflowFilesSync": {
      "repository": "joshjohanning/publish-github-action",
      "success": true,
      "workflowFiles": "would-update",
      "message": "Would sync 1 file(s) via PR",
      "filesWouldUpdate": [
        ".github/workflows/ci.yml"
      ],
      "filesProcessed": [
        ".github/workflows/ci.yml",
        ".github/workflows/publish.yml"
      ],
      "dryRun": true
    },
    "copilotInstructionsSync": {
      "repository": "joshjohanning/publish-github-action",
      "success": true,
      "copilotInstructions": "would-update",
      "message": "Would update .github/copilot-instructions.md via PR",
      "filesWouldUpdate": [
        ".github/copilot-instructions.md"
      ],
      "filesProcessed": [
        ".github/copilot-instructions.md"
      ],
      "dryRun": true
    },
    "packageJsonSync": {
      "repository": "joshjohanning/publish-github-action",
      "success": true,
      "packageJson": "unchanged",
      "message": "package.json is already up to date",
      "dryRun": true
    }
  },
  {
    "repository": "joshjohanning/ensure-immutable-actions",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "ensure-immutable-actions",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentTopics": [
      "actions",
      "github",
      "javascript",
      "node-action"
    ],
    "topicsUnchanged": true,
    "topics": [
      "github",
      "actions",
      "javascript",
      "node-action"
    ],
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentImmutableReleases": true,
    "immutableReleasesUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true,
    "dependabotSync": {
      "repository": "joshjohanning/ensure-immutable-actions",
      "success": true,
      "dependabotYml": "would-update",
      "message": "Would update .github/dependabot.yml via PR",
      "filesWouldUpdate": [
        ".github/dependabot.yml"
      ],
      "filesProcessed": [
        ".github/dependabot.yml"
      ],
      "dryRun": true
    },
    "gitignoreSync": {
      "repository": "joshjohanning/ensure-immutable-actions",
      "success": true,
      "gitignore": "unchanged",
      "message": ".gitignore is already up to date",
      "filesProcessed": [
        ".gitignore"
      ],
      "dryRun": true
    },
    "rulesetSync": {
      "repository": "joshjohanning/ensure-immutable-actions",
      "success": true,
      "ruleset": "unchanged",
      "rulesetId": 9620349,
      "message": "Ruleset \"ci\" is already up to date",
      "dryRun": true
    },
    "workflowFilesSync": {
      "repository": "joshjohanning/ensure-immutable-actions",
      "success": true,
      "workflowFiles": "would-update",
      "message": "Would sync 1 file(s) via PR",
      "filesWouldUpdate": [
        ".github/workflows/ci.yml"
      ],
      "filesProcessed": [
        ".github/workflows/ci.yml",
        ".github/workflows/publish.yml"
      ],
      "dryRun": true
    },
    "copilotInstructionsSync": {
      "repository": "joshjohanning/ensure-immutable-actions",
      "success": true,
      "copilotInstructions": "would-update",
      "message": "Would update .github/copilot-instructions.md via PR",
      "filesWouldUpdate": [
        ".github/copilot-instructions.md"
      ],
      "filesProcessed": [
        ".github/copilot-instructions.md"
      ],
      "dryRun": true
    },
    "packageJsonSync": {
      "repository": "joshjohanning/ensure-immutable-actions",
      "success": true,
      "packageJson": "unchanged",
      "message": "package.json is already up to date",
      "dryRun": true
    }
  },
  {
    "repository": "joshjohanning/azdo_commit_message_validator",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "azdo_commit_message_validator",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentTopics": [
      "actions",
      "azure-devops",
      "github",
      "javascript",
      "azure-boards",
      "node-action"
    ],
    "topicsUnchanged": true,
    "topics": [
      "github",
      "actions",
      "javascript",
      "node-action",
      "azure-devops",
      "azure-boards"
    ],
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentImmutableReleases": true,
    "immutableReleasesUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true,
    "dependabotSync": {
      "repository": "joshjohanning/azdo_commit_message_validator",
      "success": true,
      "dependabotYml": "would-update",
      "message": "Would update .github/dependabot.yml via PR",
      "filesWouldUpdate": [
        ".github/dependabot.yml"
      ],
      "filesProcessed": [
        ".github/dependabot.yml"
      ],
      "dryRun": true
    },
    "gitignoreSync": {
      "repository": "joshjohanning/azdo_commit_message_validator",
      "success": true,
      "gitignore": "unchanged",
      "message": ".gitignore is already up to date",
      "filesProcessed": [
        ".gitignore"
      ],
      "dryRun": true
    },
    "rulesetSync": {
      "repository": "joshjohanning/azdo_commit_message_validator",
      "success": true,
      "ruleset": "unchanged",
      "rulesetId": 8697207,
      "message": "Ruleset \"ci\" is already up to date",
      "dryRun": true
    },
    "workflowFilesSync": {
      "repository": "joshjohanning/azdo_commit_message_validator",
      "success": true,
      "workflowFiles": "would-update",
      "message": "Would sync 1 file(s) via PR",
      "filesWouldUpdate": [
        ".github/workflows/ci.yml"
      ],
      "filesProcessed": [
        ".github/workflows/ci.yml",
        ".github/workflows/publish.yml"
      ],
      "dryRun": true
    },
    "copilotInstructionsSync": {
      "repository": "joshjohanning/azdo_commit_message_validator",
      "success": true,
      "copilotInstructions": "would-update",
      "message": "Would update .github/copilot-instructions.md via PR",
      "filesWouldUpdate": [
        ".github/copilot-instructions.md"
      ],
      "filesProcessed": [
        ".github/copilot-instructions.md"
      ],
      "dryRun": true
    }
  },
  {
    "repository": "joshjohanning/generate-org-repos-sbom-action",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "generate-org-repos-sbom-action",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentTopics": [
      "actions",
      "advanced-security",
      "github",
      "node-action",
      "typescript"
    ],
    "topicsUnchanged": true,
    "topics": [
      "github",
      "actions",
      "typescript",
      "node-action",
      "advanced-security"
    ],
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true
  },
  {
    "repository": "joshjohanning/actions-ref-linter",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "actions-ref-linter",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentTopics": [
      "actions",
      "github",
      "composite-action",
      "shell"
    ],
    "topicsUnchanged": true,
    "topics": [
      "github",
      "actions",
      "shell",
      "composite-action"
    ],
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true,
    "dependabotSync": {
      "repository": "joshjohanning/actions-ref-linter",
      "success": true,
      "dependabotYml": "would-update",
      "message": "Would update .github/dependabot.yml via PR",
      "filesWouldUpdate": [
        ".github/dependabot.yml"
      ],
      "filesProcessed": [
        ".github/dependabot.yml"
      ],
      "dryRun": true
    }
  },
  {
    "repository": "joshjohanning/enforce-github-pat-expiration",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "enforce-github-pat-expiration",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentTopics": [
      "actions",
      "github",
      "administration",
      "personal-access-tokens",
      "composite-action",
      "shell"
    ],
    "topicsUnchanged": true,
    "topics": [
      "github",
      "actions",
      "shell",
      "composite-action",
      "administration",
      "personal-access-tokens"
    ],
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true,
    "dependabotSync": {
      "repository": "joshjohanning/enforce-github-pat-expiration",
      "success": true,
      "dependabotYml": "would-update",
      "message": "Would update .github/dependabot.yml via PR",
      "filesWouldUpdate": [
        ".github/dependabot.yml"
      ],
      "filesProcessed": [
        ".github/dependabot.yml"
      ],
      "dryRun": true
    }
  },
  {
    "repository": "joshjohanning/revoke-github-ssh-key-sso-authorization",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "revoke-github-ssh-key-sso-authorization",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentTopics": [
      "actions",
      "administration",
      "github",
      "ssh-keys",
      "composite-action",
      "shell"
    ],
    "topicsUnchanged": true,
    "topics": [
      "github",
      "actions",
      "shell",
      "composite-action",
      "administration",
      "ssh-keys"
    ],
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true,
    "dependabotSync": {
      "repository": "joshjohanning/revoke-github-ssh-key-sso-authorization",
      "success": true,
      "dependabotYml": "would-update",
      "message": "Would update .github/dependabot.yml via PR",
      "filesWouldUpdate": [
        ".github/dependabot.yml"
      ],
      "filesProcessed": [
        ".github/dependabot.yml"
      ],
      "dryRun": true
    }
  },
  {
    "repository": "joshjohanning/text-to-emoji-action",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "text-to-emoji-action",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentTopics": [
      "actions",
      "github",
      "composite-action",
      "shell"
    ],
    "topicsUnchanged": true,
    "topics": [
      "github",
      "actions",
      "shell",
      "composite-action"
    ],
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true,
    "dependabotSync": {
      "repository": "joshjohanning/text-to-emoji-action",
      "success": true,
      "dependabotYml": "would-update",
      "message": "Would update .github/dependabot.yml via PR",
      "filesWouldUpdate": [
        ".github/dependabot.yml"
      ],
      "filesProcessed": [
        ".github/dependabot.yml"
      ],
      "dryRun": true
    }
  },
  {
    "repository": "joshjohanning/sync-github-repo-settings",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "sync-github-repo-settings",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentTopics": [
      "github",
      "github-settings",
      "settings-sync"
    ],
    "topicsUnchanged": true,
    "topics": [
      "github",
      "github-settings",
      "settings-sync"
    ],
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true,
    "dependabotSync": {
      "repository": "joshjohanning/sync-github-repo-settings",
      "success": true,
      "dependabotYml": "would-update",
      "message": "Would update .github/dependabot.yml via PR",
      "filesWouldUpdate": [
        ".github/dependabot.yml"
      ],
      "filesProcessed": [
        ".github/dependabot.yml"
      ],
      "dryRun": true
    },
    "gitignoreSync": {
      "repository": "joshjohanning/sync-github-repo-settings",
      "success": true,
      "gitignore": "unchanged",
      "message": ".gitignore is already up to date",
      "filesProcessed": [
        ".gitignore"
      ],
      "dryRun": true
    }
  },
  {
    "repository": "joshjohanning/hsa-expense-analyzer-cli",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "hsa-expense-analyzer-cli",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentImmutableReleases": true,
    "immutableReleasesUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true,
    "dependabotSync": {
      "repository": "joshjohanning/hsa-expense-analyzer-cli",
      "success": true,
      "dependabotYml": "would-update",
      "message": "Would update .github/dependabot.yml via PR",
      "filesWouldUpdate": [
        ".github/dependabot.yml"
      ],
      "filesProcessed": [
        ".github/dependabot.yml"
      ],
      "dryRun": true
    },
    "gitignoreSync": {
      "repository": "joshjohanning/hsa-expense-analyzer-cli",
      "success": true,
      "gitignore": "unchanged",
      "message": ".gitignore is already up to date",
      "filesProcessed": [
        ".gitignore"
      ],
      "dryRun": true
    }
  },
  {
    "repository": "joshjohanning/make-coverage-badge-better",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "make-coverage-badge-better",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentImmutableReleases": true,
    "immutableReleasesUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true,
    "dependabotSync": {
      "repository": "joshjohanning/make-coverage-badge-better",
      "success": true,
      "dependabotYml": "would-update",
      "message": "Would update .github/dependabot.yml via PR",
      "filesWouldUpdate": [
        ".github/dependabot.yml"
      ],
      "filesProcessed": [
        ".github/dependabot.yml"
      ],
      "dryRun": true
    },
    "gitignoreSync": {
      "repository": "joshjohanning/make-coverage-badge-better",
      "success": true,
      "gitignore": "unchanged",
      "message": ".gitignore is already up to date",
      "filesProcessed": [
        ".gitignore"
      ],
      "dryRun": true
    }
  },
  {
    "repository": "joshjohanning/github-misc-scripts",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "github-misc-scripts",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true,
    "dependabotSync": {
      "repository": "joshjohanning/github-misc-scripts",
      "success": true,
      "dependabotYml": "would-update",
      "message": "Would update .github/dependabot.yml via PR",
      "filesWouldUpdate": [
        ".github/dependabot.yml"
      ],
      "filesProcessed": [
        ".github/dependabot.yml"
      ],
      "dryRun": true
    }
  },
  {
    "repository": "joshjohanning/envisalink-syslog-listener",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "envisalink-syslog-listener",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentImmutableReleases": true,
    "immutableReleasesUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true,
    "dependabotSync": {
      "repository": "joshjohanning/envisalink-syslog-listener",
      "success": true,
      "dependabotYml": "would-update",
      "message": "Would update .github/dependabot.yml via PR",
      "filesWouldUpdate": [
        ".github/dependabot.yml"
      ],
      "filesProcessed": [
        ".github/dependabot.yml"
      ],
      "dryRun": true
    }
  },
  {
    "repository": "joshjohanning/rpi-scripts",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "rpi-scripts",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentSecretScanning": false,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": false,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true,
    "dependabotSync": {
      "repository": "joshjohanning/rpi-scripts",
      "success": true,
      "dependabotYml": "would-update",
      "message": "Would update .github/dependabot.yml via PR",
      "filesWouldUpdate": [
        ".github/dependabot.yml"
      ],
      "filesProcessed": [
        ".github/dependabot.yml"
      ],
      "dryRun": true
    }
  },
  {
    "repository": "joshjohanning/joshjohanning.github.io",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "joshjohanning.github.io",
      "allow_squash_merge": false,
      "allow_merge_commit": true,
      "allow_rebase_merge": false,
      "allow_auto_merge": false,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": false,
      "allow_merge_commit": true,
      "allow_rebase_merge": false,
      "allow_auto_merge": false,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": false,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": false,
    "dependabotSecurityUpdatesUnchanged": true
  },
  {
    "repository": "joshjohanning/approved-actions-enforcer-app",
    "success": true,
    "hasWarnings": false,
    "settings": {
      "owner": "joshjohanning",
      "repo": "approved-actions-enforcer-app",
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "currentSettings": {
      "allow_squash_merge": true,
      "allow_merge_commit": false,
      "allow_rebase_merge": false,
      "allow_auto_merge": true,
      "delete_branch_on_merge": true,
      "allow_update_branch": true
    },
    "changes": [],
    "dryRun": true,
    "currentCodeScanning": "configured",
    "codeScanningUnchanged": true,
    "currentImmutableReleases": true,
    "immutableReleasesUnchanged": true,
    "currentSecretScanning": true,
    "secretScanningUnchanged": true,
    "currentSecretScanningPushProtection": true,
    "secretScanningPushProtectionUnchanged": true,
    "currentDependabotAlerts": true,
    "dependabotAlertsUnchanged": true,
    "currentDependabotSecurityUpdates": true,
    "dependabotSecurityUpdatesUnchanged": true
  }
]

[Copilot]

Pull request overview

This PR tightens npm dependency-install behavior in synced workflow/templates and repo documentation, aiming to reduce supply-chain risk by disabling install scripts and (intended) blocking git-based dependencies, and adds a Dependabot throttling setting across templates.

Changes:

• Update npm install/ci commands in workflow(s) and contributor instructions to use --ignore-scripts and --allow-git=none.
• Add .npmrc defaults (and a template .npmrc) to enforce the same behaviors repository-wide.
• Add a cooldown: default-days: 3 setting to Dependabot configs/templates.

Show a summary per file

File	Description
config/workflows/ci.yml	Template CI workflow now runs npm ci with stricter flags.
config/npmrc/.npmrc	Adds a template .npmrc intended to enforce npm install restrictions by default.
config/dependabot/npm-actions.yml	Adds cooldown to Dependabot template for Actions + npm updates.
config/dependabot/npm-actions-no-octokit.yml	Adds cooldown to Dependabot template variant.
config/dependabot/actions.yml	Adds cooldown to Dependabot Actions-only template.
config/dependabot/actions-npm-security-grouped.yml	Adds cooldown to grouped Actions/npm-security Dependabot template.
config/copilot/copilot-instructions-actions.md	Updates contributor guidance to include the new npm install flags.
.npmrc	Sets npm defaults in this repo to match the new install policy.
.gitignore	Ignores node_modules.
.github/workflows/find-actions-repos.yml	Uses stricter npm install flags when installing js-yaml.
.github/dependabot.yml	Adds cooldown to this repo’s Dependabot config.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (3)

config/dependabot/actions-npm-security-grouped.yml:31

• Dependabot’s config schema does not include a cooldown key, so these additions may invalidate the template when synced. Consider removing cooldown (or using supported schedule/ignore controls instead).

      interval: 'weekly'
    open-pull-requests-limit: 0
    cooldown:
      default-days: 3

config/dependabot/npm-actions-no-octokit.yml:36

• Dependabot’s config schema does not include a cooldown key, so this template is likely invalid when synced to downstream repos. Consider removing cooldown or replacing it with supported scheduling/ignore options.

    commit-message:
      prefix: 'chore'
      include: 'scope'
    cooldown:
      default-days: 3

config/dependabot/npm-actions.yml:36

• Dependabot’s config schema does not include a cooldown key, so this addition may invalidate the template when synced to downstream repos. Consider removing cooldown (or using supported schedule/ignore controls instead).

      prefix: 'chore'
      include: 'scope'
    cooldown:
      default-days: 3

• Files reviewed: 10/11 changed files
• Comments generated: 10