Function pruneMissingSelectedRepos

services/security-sync/src/sync.ts:1549–1594

Remove selected_repository_ids that are no longer accessible via the GitHub installation. * Unlike pruneStaleReposFromConfig (which prunes by repo name after sync), this handles * repos that silently vanished from the installation and were never synced at all.

(
  db: WorkerDb,
  owner: SecurityReviewOwner,
  accessibleRepoIds: Set<number>
)

}

async function insertStagedNewFindingNotifications(
  db: Pick<WorkerDb, 'insert'>,
  params: {
    findingId: string;
    recipientUserIds: string[];
  }
): Promise<number> {
  if (params.recipientUserIds.length === 0) return 0;

  const inserted = await db
    .insert(security_finding_notifications)
    .values(
      params.recipientUserIds.map(recipientUserId => ({
        finding_id: params.findingId,
        recipient_user_id: recipientUserId,
        kind: 'new_finding' as const,
        status: 'staged' as const,
      }))
    )
    .onConflictDoNothing()
    .returning({ id: security_finding_notifications.id });

  return inserted.length;
}

async function finalizeStagedNewFindingNotifications(
  db: Pick<WorkerDb, 'execute'>,
  params: { owner: SecurityReviewOwner; repoFullName: string }
): Promise<{ pending: number; cancelled: number }> {
  const result = await db.execute<{ status: 'pending' | 'cancelled'; count: number }>(sql`
    WITH finalized AS (
      UPDATE ${security_finding_notifications}
      SET
        status = CASE
          WHEN ${security_findings.status} = 'open'
            AND COALESCE(${security_findings.ignored_reason}, '') NOT LIKE 'superseded:%'
          THEN 'pending'
          ELSE 'cancelled'
        END,
        updated_at = now()
      FROM ${security_findings}
      WHERE ${security_finding_notifications.finding_id} = ${security_findings.id}
        AND ${security_finding_notifications.kind} = 'new_finding'
        AND ${security_finding_notifications.status} = 'staged'
        AND ${security_findings.repo_full_name} = ${params.repoFullName}
        AND ${findingOwnerPredicate(params.owner)}
      RETURNING ${security_finding_notifications.status}
    )
    SELECT status, count(*)::int AS count