From 99ea18211c75d9de58a9398e354b92e52adc3a45 Mon Sep 17 00:00:00 2001
From: jan-kubica <jankubica@protonmail.com>
Date: Sat, 29 Aug 2026 18:50:09 +0200
Subject: [PATCH 1/3] feat: adopt shared quarantine policy

---
 .github/workflows/quarantine-policy.yml | 16 ++++++++++++++++
 .github/workflows/quarantine-prune.yml  | 20 ++++++++++++++++++++
 bunfig.toml                             |  5 ++---
 3 files changed, 38 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/quarantine-policy.yml
 create mode 100644 .github/workflows/quarantine-prune.yml

diff --git a/.github/workflows/quarantine-policy.yml b/.github/workflows/quarantine-policy.yml
new file mode 100644
index 0000000..d40e1bd
--- /dev/null
+++ b/.github/workflows/quarantine-policy.yml
@@ -0,0 +1,16 @@
+name: Package quarantine policy
+
+on:
+  pull_request:
+  merge_group:
+
+permissions:
+  contents: read
+
+jobs:
+  enforce:
+    name: Enforce package quarantine
+    if: github.repository == 'stella/stdnum'
+    permissions:
+      contents: read
+    uses: stella/.github/.github/workflows/quarantine-policy.yml@8cd71d93edeb4d7c433c6a75c4be409fbd1c50bb
diff --git a/.github/workflows/quarantine-prune.yml b/.github/workflows/quarantine-prune.yml
new file mode 100644
index 0000000..58aae96
--- /dev/null
+++ b/.github/workflows/quarantine-prune.yml
@@ -0,0 +1,20 @@
+name: Package quarantine prune
+
+on:
+  schedule:
+    - cron: "11 * * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  prune:
+    name: Remove expired quarantine exceptions
+    if: github.repository == 'stella/stdnum'
+    permissions:
+      contents: read
+    uses: stella/.github/.github/workflows/quarantine-prune.yml@8cd71d93edeb4d7c433c6a75c4be409fbd1c50bb
+    secrets:
+      RELEASE_APP_ID: ${{ secrets.RELEASE_APP_ID }}
+      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
diff --git a/bunfig.toml b/bunfig.toml
index 523afff..a7a9ea1 100644
--- a/bunfig.toml
+++ b/bunfig.toml
@@ -3,7 +3,6 @@
 # less than 5 days ago to mitigate supply chain attacks.
 minimumReleaseAge = 432_000
 minimumReleaseAgeExcludes = [
-  "@stll/oxlint-config",
-  "@stll/typescript-config",
-  "bun-types@1.4.0", # quarantine-expires: 2026-08-25T14:11:33.785Z
+  "@stll/oxlint-config", # quarantine-excluded-since: 2026-06-03T14:49:06.000Z
+  "@stll/typescript-config", # quarantine-excluded-since: 2026-06-03T14:49:06.000Z
 ]

From c1889cfb01c462c5c2d64eecb9e7ab24d447e341 Mon Sep 17 00:00:00 2001
From: jan-kubica <jankubica@protonmail.com>
Date: Sat, 29 Aug 2026 20:23:29 +0200
Subject: [PATCH 2/3] fix: restrict quarantine pruning to schedules

---
 .github/workflows/quarantine-policy.yml | 2 +-
 .github/workflows/quarantine-prune.yml  | 3 +--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/quarantine-policy.yml b/.github/workflows/quarantine-policy.yml
index d40e1bd..8471dfb 100644
--- a/.github/workflows/quarantine-policy.yml
+++ b/.github/workflows/quarantine-policy.yml
@@ -13,4 +13,4 @@ jobs:
     if: github.repository == 'stella/stdnum'
     permissions:
       contents: read
-    uses: stella/.github/.github/workflows/quarantine-policy.yml@8cd71d93edeb4d7c433c6a75c4be409fbd1c50bb
+    uses: stella/.github/.github/workflows/quarantine-policy.yml@76807b4423de63c1216a1ed7437268c4c1c20d7c
diff --git a/.github/workflows/quarantine-prune.yml b/.github/workflows/quarantine-prune.yml
index 58aae96..749bd7d 100644
--- a/.github/workflows/quarantine-prune.yml
+++ b/.github/workflows/quarantine-prune.yml
@@ -3,7 +3,6 @@ name: Package quarantine prune
 on:
   schedule:
     - cron: "11 * * * *"
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -14,7 +13,7 @@ jobs:
     if: github.repository == 'stella/stdnum'
     permissions:
       contents: read
-    uses: stella/.github/.github/workflows/quarantine-prune.yml@8cd71d93edeb4d7c433c6a75c4be409fbd1c50bb
+    uses: stella/.github/.github/workflows/quarantine-prune.yml@76807b4423de63c1216a1ed7437268c4c1c20d7c
     secrets:
       RELEASE_APP_ID: ${{ secrets.RELEASE_APP_ID }}
       RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

From 78580879d1eec0dcc387a37a31ff78a0996d5e0f Mon Sep 17 00:00:00 2001
From: jan-kubica <jankubica@protonmail.com>
Date: Sat, 29 Aug 2026 21:28:31 +0200
Subject: [PATCH 3/3] fix: enforce quarantine lockfile ingress

---
 .github/workflows/quarantine-policy.yml | 2 +-
 .github/workflows/quarantine-prune.yml  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/quarantine-policy.yml b/.github/workflows/quarantine-policy.yml
index 8471dfb..fdf9a37 100644
--- a/.github/workflows/quarantine-policy.yml
+++ b/.github/workflows/quarantine-policy.yml
@@ -13,4 +13,4 @@ jobs:
     if: github.repository == 'stella/stdnum'
     permissions:
       contents: read
-    uses: stella/.github/.github/workflows/quarantine-policy.yml@76807b4423de63c1216a1ed7437268c4c1c20d7c
+    uses: stella/.github/.github/workflows/quarantine-policy.yml@699affd63b2d956f71b9833fbed239245aff7e86
diff --git a/.github/workflows/quarantine-prune.yml b/.github/workflows/quarantine-prune.yml
index 749bd7d..791aebe 100644
--- a/.github/workflows/quarantine-prune.yml
+++ b/.github/workflows/quarantine-prune.yml
@@ -13,7 +13,7 @@ jobs:
     if: github.repository == 'stella/stdnum'
     permissions:
       contents: read
-    uses: stella/.github/.github/workflows/quarantine-prune.yml@76807b4423de63c1216a1ed7437268c4c1c20d7c
+    uses: stella/.github/.github/workflows/quarantine-prune.yml@699affd63b2d956f71b9833fbed239245aff7e86
     secrets:
       RELEASE_APP_ID: ${{ secrets.RELEASE_APP_ID }}
       RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}