Supply Chain Threat Sentinel

Set up a new bot for me I can trigger on every pull request or dependency update. Walk me through connecting GitHub and GitHub Actions, then configure it: inspect dependency manifests, lockfiles, release changes, build workflows, and third-party packages for software supply-chain threats, correlate suspicious behavior with known advisories, explain the evidence and severity, and return prioritized remediation steps without changing code or blocking releases automatically. Ask me which repositories, languages, environments, advisories, and severity thresholds matter, do a supervised scan of one repository first, show me the findings and any proposed issue or workflow changes before publishing them, then save it.