Function pruneStaleReposFromConfig

services/security-sync/src/sync.ts:1487–1544

(
  db: WorkerDb,
  owner: SecurityReviewOwner,
  staleRepoNames: string[],
  repoNameToId: Map<string, number>
)

      sourceOccurredAt: finding.raw_data.updated_at,
      eventKey: deriveSecurityFindingAuditEventKey([
        ...keyBase,
        SecurityAuditLogAction.FindingSeverityChanged,
        finding.raw_data.updated_at,
        upserted.previousSeverity,
        upserted.effectiveSeverity,
      ]),
      sourceContext: SecurityFindingAuditSourceContext.SecuritySync,
      beforeState: { severity: upserted.previousSeverity },
      afterState: { severity: upserted.effectiveSeverity },
      metadata: commonMetadata,
    });
  }

  if (upserted.previousStatus !== null && upserted.previousStatus !== upserted.effectiveStatus) {
    const action = getSyncStatusAuditAction(finding.raw_data.state);
    const sourceOccurredAt = getStatusSourceOccurredAt(finding);
    await insertSecurityFindingAuditEvent(db, {
      owner: auditOwner,
      finding: auditFinding,
      actor: SECURITY_FINDING_AUDIT_SYSTEM_ACTOR,
      action,
      occurredAt,
      sourceOccurredAt,
      eventKey: deriveSecurityFindingAuditEventKey([
        ...keyBase,
        action,
        sourceOccurredAt,
        upserted.previousStatus,
        upserted.effectiveStatus,
      ]),
      sourceContext: SecurityFindingAuditSourceContext.SecuritySync,
      beforeState: { status: upserted.previousStatus },
      afterState: {
        status: upserted.effectiveStatus,
        ...(finding.ignored_reason ? { reason_code: finding.ignored_reason } : {}),
        ...(finding.fixed_at ? { fixed_at: new Date(finding.fixed_at).toISOString() } : {}),
      },
      metadata: commonMetadata,
    });
  }
}

function getSyncStatusAuditAction(state: DependabotAlertState): SecurityAuditLogAction {
  if (state === 'auto_dismissed') return SecurityAuditLogAction.FindingAutoDismissed;
  if (state === 'dismissed') return SecurityAuditLogAction.FindingDismissed;
  return SecurityAuditLogAction.FindingStatusChange;
}

function getStatusSourceOccurredAt(finding: ParsedSecurityFinding): string {
  if (finding.raw_data.state === 'auto_dismissed') {
    return (
      finding.raw_data.auto_dismissed_at ??
      finding.raw_data.dismissed_at ??
      finding.raw_data.updated_at
    );
  }
  if (finding.raw_data.state === 'dismissed') {
    return finding.raw_data.dismissed_at ?? finding.raw_data.updated_at;