repo-sentinel

A reusable GitHub Actions workflow that scans a repo with Trivy for dependency vulnerabilities, secrets and misconfig, and with CodeQL for semantic code analysis. Both upload SARIF to the Security tab, then findings above a severity threshold become deduplicated GitHub issues, and pull request runs keep one sticky comment updated. Issues and PR comments can tag Copilot to help remediate. A one-line installer drops a thin caller workflow into your repo and pins an exact release, so all the scanning logic stays in repo-sentinel.