run dependency review only on pull requests

[rtpascual]

Problem

dependency-review-action is meant to only run on pull request, when pushing it fails with https://github.com/aws-amplify/amplify-backend/actions/runs/8977249446/job/24655630829#step:3:6.

Issue number, if available:

Changes

• Have dependency-review-action run only on pull requests
• Pin dependency-review-action to a specific commit hash for the current latest version 4.3.2

Corresponding docs PR, if applicable:

Validation

PR checks

Checklist

• If this PR includes a functional change to the runtime behavior of the code, I have added or updated automated test coverage for this change.
• If this PR requires a change to the Project Architecture README, I have included that update in this PR.
• If this PR requires a docs update, I have linked to that docs PR above.
• If this PR modifies E2E tests, makes changes to resource provisioning, or makes SDK calls, I have run the PR checks with the run-e2e label set.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[changeset-bot]

🦋 Changeset detected

Latest commit: 9c63140

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[sobolk]

Why not this

amplify-backend/.github/workflows/health_checks.yml

Line 99 in d1716d1

if: github.event_name == 'pull_request'

?

[edwardfoyle]

Since this job doesn't depend on any other steps, it's probably fine as a separate workflow. But yeah, this could also work

[rtpascual]

We can do that too, I assumed every check in health_checks follows this

amplify-backend/.github/workflows/health_checks.yml

Lines 4 to 13 in d1716d1

	push:
	branches:
	- main
	- hotfix
	pull_request:
	branches:
	- main
	- hotfix
	- feature/**
	workflow_dispatch:

as that line seems easy to miss (which is very true in my case since I didn't see that line).

I added dependency review back and added the if line.

[0618]

why don't we use the commit hash here?

[rtpascual]

I don't have a strong opinion, we can just like what we do with checkout. Seems like only flutter does this and does not use a commit hash https://github.com/search?q=org%3Aaws-amplify%20dependency-review-action&type=code