From 28f683089bc7cf32d59d3b61204b887994a70e36 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Sun, 26 Jul 2026 17:46:36 +0000 Subject: [PATCH] Only comment dependency-review summary on failure to hide benign fork-PR snapshot warning (#212) Co-Authored-By: Andreas Igel --- .github/workflows/dependency-review.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 9e8129dd..0da9b502 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -49,10 +49,17 @@ jobs: uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0 # Commonly enabled options, see https://github.com/actions/dependency-review-action#configuration-options for all available options. with: - comment-summary-in-pr: always + # Only post/refresh the PR summary comment when the review actually + # fails (a vulnerability or denied license). This avoids spamming + # every PR with a comment whose only content is the benign + # "No snapshots were found for the head SHA" warning: for fork PRs + # GitHub has only the manifest-derived dependency graph (no submitted + # snapshot for the fork head, and one can't be produced without + # building untrusted fork code with a write token). The check still + # runs and still fails on real issues; the warning is only visible in + # the Actions run log. + comment-summary-in-pr: on-failure # Fail the PR when it introduces a vulnerability at or above this severity. fail-on-severity: high # Block copyleft / incompatible licenses that conflict with this MIT project. deny-licenses: GPL-1.0-or-later, GPL-2.0-or-later, GPL-3.0-or-later, LGPL-2.0-or-later, LGPL-2.1-or-later, LGPL-3.0-or-later, AGPL-3.0-or-later - # Snapshot dependency data can lag right after a push; retry instead of failing spuriously. - retry-on-snapshot-warnings: true