Supply Chain Threat Sentinel

Watch every pull request and dependency update for supply-chain threats. Walk me through connecting GitHub and GitHub Actions, then configure it: inspect dependency manifests, lockfiles, release changes, build workflows, and third-party packages for software supply-chain threats, correlate suspicious behavior with known advisories, explain the evidence and severity, and return prioritized remediation steps without changing code or blocking releases automatically. Ask me which repositories, languages, environments, advisories, and severity thresholds matter, do a supervised scan of one repository first, show me the findings and any proposed issue or workflow changes before publishing them, then save it.