Try to add a PR check step which will enforce the package quarantine for transitive dependencies (to prevent build, which does enforce this, from breaking)

[Alex Ross (alexr00)]

No description provided.

[Copilot]

Copilot review overview

🟡 Changes recommended

Fix the test module resolution and case-insensitive base-tree lookup before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Lite
Findings: 1 · 1

New issues introduced by this change (2)

Severity	Finding
	src/​test/​scripts/​checkPackageQuarantine.test.ts — This dynamic, source-relative require is not compatible with both supported test layouts. `npm…
	scripts/​check-package-quarantine.js — The current-tree check treats npm-shrinkwrap.json case-insensitively, but this base-tree lookup…

What changed in this PR

Adds a PR CI gate enforcing a seven-day quarantine for new or changed transitive npm dependencies before installation.

Changes:

• Adds lockfile and npm registry quarantine validation.
• Adds comprehensive validation tests.
• Integrates the check into PR CI and fetches the base commit.
• Registers the check script.

File	Summary
src/​test/​scripts/​checkPackageQuarantine.test.ts	Tests quarantine validation; module resolution must support both test layouts.
scripts/​ci/​common-setup.yml	Runs the quarantine check before installation.
scripts/​check-package-quarantine.js	Implements validation; base-tree shrinkwrap detection must be case-insensitive.
package.json	Registers the quarantine check script.
azure-pipeline.pr.yml	Fetches the base commit for comparison.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

The CI check can be bypassed, and legitimate lockfile entries may be rejected.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Lite
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	scripts/​ci/​common-setup.yml — This does not enforce the quarantine check: the PR controls package.json, including the…

Issues resolved since last review (2)

Severity	Finding
	scripts/​check-package-quarantine.js — The current-tree check treats npm-shrinkwrap.json case-insensitively, but this base-tree lookup… View resolved comment
	src/​test/​scripts/​checkPackageQuarantine.test.ts — This dynamic, source-relative require is not compatible with both supported test layouts. `npm… View resolved comment

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

scripts/check-package-quarantine.js:299

• npm's lockfile format can omit resolved/integrity on alias and nested duplicate entries (the repository's own node_modules/string-width-cjs is an example). If a PR introduces or moves such an entry, findChangedPackageVersions treats it as new because the missing fields differ from the canonical copy, and this guard rejects it before any registry lookup. That blocks legitimate transitive updates even when the canonical name/version is already present; normalize/reuse the canonical artifact metadata (or otherwise verify the alias target) before requiring both fields.