A team reviews whether this workflow prevents a Copilot-generated pull request from deleting production data without a controlled human approval step. Evaluate the following statements. 1. The apply job can be held by protection rules on regulated-production. 2. The pull_request trigger alone proves the change is compliance-approved. 3. The validation job separates plan review from production application.

name: controlled-data-retention-change

on:
  pull_request:
    branches:
      - main
    paths:
      - "retention/**"
      - ".github/workflows/controlled-data-retention-change.yml"

permissions:
  contents: read
  pull-requests: read

jobs:
  review-plan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Validate retention policy plan
        run: ./scripts/validate-retention-plan.sh

   apply-retention-policy:
     needs: review-plan
     runs-on: ubuntu-latest
     environment: regulated-production
     steps:
       - uses: actions/checkout@v4
       - name: Apply retention policy
         run: ./scripts/apply-retention-policy.sh