> But not before it had triggered some infosec alert and they blasted me with a stern “ACTION REQUIRED” email.

Why didn’t it fail the build before it was committed if they can automatically do this