chore(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 3adb4b14a2b0623876d18d863a498b785fb3752d to 9a498708959aeaef5ef730655706c5a1df1edbc2 - #36
Conversation
…nner-reusable-pr.yml Bumps [google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml](https://github.com/google/osv-scanner-action) from 3adb4b14a2b0623876d18d863a498b785fb3752d to 9a498708959aeaef5ef730655706c5a1df1edbc2. - [Release notes](https://github.com/google/osv-scanner-action/releases) - [Commits](google/osv-scanner-action@3adb4b1...3adb4b1) --- updated-dependencies: - dependency-name: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml dependency-version: 3adb4b14a2b0623876d18d863a498b785fb3752d dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 337182c99b
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| scan-pr: | ||
| if: ${{ github.event_name == 'pull_request' }} | ||
| uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@3adb4b14a2b0623876d18d863a498b785fb3752d # v2.3.8 | ||
| uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8 |
There was a problem hiding this comment.
This change updates a pinned reusable workflow under .github/workflows/, but the repo’s AGENTS.md Security and Supply-Chain Rules explicitly say “Never modify files in .github/workflows/ without explicit user approval.” Because this is a CI security-scanner workflow digest change, merging it without that explicit approval bypasses the repository’s supply-chain control; please document/obtain approval for this workflow update before accepting it.
Useful? React with 👍 / 👎.
1 participant
Bumps google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 3adb4b14a2b0623876d18d863a498b785fb3752d to 9a498708959aeaef5ef730655706c5a1df1edbc2.
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)