Repository navigation

fix(sandbox): recognize Bash line-number exec denials #76

	name: Sentinel
	on: { pull_request: {} }
	permissions: { contents: read, pull-requests: write }
	jobs:
	audit:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
	- name: Sentinel audit (enforce)
	uses: ./
	with:
	fail-on: block
	# Signed self-audit policy: waives reviewed heuristic findings on our
	# own dev deps (see policy/sentinel-policy.json `allow` reasons);
	# anything new still blocks.
	policy: policy/sentinel-policy.json
	policy-pubkey: policy/sentinel-policy.pub.pem
	# Observe-only onboarding variant:
	# with: { fail-on: none }