From e3da496af745163a5a931b4fc72ef228882c885a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 7 Nov 2023 12:29:50 +0100 Subject: [PATCH] chore(deps): bump actions/dependency-review-action from 3.1.0 to 3.1.1 (#189) * chore(deps): bump actions/dependency-review-action from 3.1.0 to 3.1.1 Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 3.1.0 to 3.1.1. - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](https://github.com/actions/dependency-review-action/compare/6c5ccdad469c9f8a2996bfecaec55a631a347034...9f45b2463b475767b61721ccfef113fef513e6aa) --- updated-dependencies: - dependency-name: actions/dependency-review-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] * chore: fail only on critical findings * chore: disable too noisy license check * chore: only show dependency review comment on failure --------- Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ron <45816308+rjaegers@users.noreply.github.com> --- .github/workflows/build-push.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-push.yml b/.github/workflows/build-push.yml index c3f02d07..a3526417 100644 --- a/.github/workflows/build-push.yml +++ b/.github/workflows/build-push.yml @@ -67,10 +67,11 @@ jobs: with: image: ${{ env.REGISTRY }}/${{ github.repository }}@${{ steps.build-and-push.outputs.digest }} dependency-snapshot: true - - uses: actions/dependency-review-action@6c5ccdad469c9f8a2996bfecaec55a631a347034 # v3.1.0 + - uses: actions/dependency-review-action@9f45b2463b475767b61721ccfef113fef513e6aa # v3.1.1 if: ${{ github.event_name == 'pull_request' }} with: - comment-summary-in-pr: always + comment-summary-in-pr: on-failure + fail-on-severity: critical - name: Sign the image with GitHub OIDC token if: ${{ github.event_name != 'merge_group' }} # This step uses the GitHub OIDC identity token to provision an ephemeral certificate