Function buildPolicy

scripts/github-actions/post-review-comments.js:1398–1429

({ severityThreshold, categories } = {})

//     categories: Set<string>,        // lowercase enum members; empty when disabled
//   }
function buildPolicy({ severityThreshold, categories } = {}) {
  let routeBySeverity = false;
  let severityRank = -1;
  if (severityThreshold != null) {
    const norm = String(severityThreshold).trim().toLowerCase();
    if (SEVERITY_RANK.has(norm)) {
      routeBySeverity = true;
      severityRank = SEVERITY_RANK.get(norm);
    }
    // Any other value (empty, unknown, garbage) leaves routeBySeverity=false
    // (fail-open for the policy: unknown threshold -> no routing).
  }

  let routeByCategory = false;
  const categorySet = new Set();
  if (categories != null) {
    const tokens = String(categories)
      .split(",")
      .map((t) => t.trim().toLowerCase())
      .filter((t) => t.length > 0);
    for (const t of tokens) {
      if (CATEGORIES.includes(t)) categorySet.add(t);
      // Unknown category tokens are silently dropped (fail-open: an unknown
      // category in the policy never matches a finding's category, so including
      // it would be a no-op anyway; dropping keeps the set clean).
    }
    if (categorySet.size > 0) routeByCategory = true;
  }

  if (!routeBySeverity && !routeByCategory) return NO_ROUTING;
  return { routeBySeverity, severityRank, routeByCategory, categories: categorySet };
}

// Decide whether a comment routes to the summary per the policy. Returns
// { routed: true, reason } or { routed: false }. A finding matches when its