ci: bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 2.3.3 to 2.3.5 - #67
Conversation
…able.yml Bumps [google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml](https://github.com/google/osv-scanner-action) from 2.3.3 to 2.3.5. - [Release notes](https://github.com/google/osv-scanner-action/releases) - [Commits](google/osv-scanner-action@c5996e0...c518547) --- updated-dependencies: - dependency-name: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml dependency-version: 2.3.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| scan-scheduled: | ||
| if: github.event_name == 'push' || github.event_name == 'schedule' | ||
| uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@c5996e0193a3df57d695c1b8a1dec2a4c62e8730" # v2.3.3 | ||
| uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@c51854704019a247608d928f370c98740469d4b5" # v2.3.5 |
There was a problem hiding this comment.
🟡 Inconsistent OSV Scanner version: scan-pr still pinned to v2.3.3 while scan-scheduled bumped to v2.3.5
The PR updates the scan-scheduled job to use google/osv-scanner-action at commit c51854704019a247608d928f370c98740469d4b5 (v2.3.5), but the scan-pr job on line 14 still references the old commit c5996e0193a3df57d695c1b8a1dec2a4c62e8730 (v2.3.3). Both jobs reference reusable workflows from the same google/osv-scanner-action repository, so they should be updated together to maintain version consistency. This is an incomplete version bump.
Prompt for agents
In .github/workflows/osv-scanner.yml, update the scan-pr job on line 14 to also use the v2.3.5 commit hash. Change:
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@c5996e0193a3df57d695c1b8a1dec2a4c62e8730" # v2.3.3
to use the v2.3.5 commit hash (you will need to look up the correct commit hash for osv-scanner-reusable-pr.yml at v2.3.5, which may or may not be the same as c51854704019a247608d928f370c98740469d4b5 used for the other workflow).
Was this helpful? React with 👍 or 👎 to provide feedback.
Bumps google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 2.3.3 to 2.3.5.
Release notes
Sourced from google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml's releases.
Commits
c518547Merge pull request #124 from google/update-to-v2.3.51fc5ec2Update unified workflow example to point to v2.3.5 reusable workflows3d5827dUpdate reusable workflows to point to v2.3.5 actions7222d1c"Update actions to use v2.3.5 osv-scanner image"a30b4c3Merge pull request #120 from google/lsc-1771431861.838104562f47c7Fix missing env var after the initial changeb7ee968Refactor Github Action per b/485167538Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)