From 1cad5ba46e76db89e33f90f803fc28d399e0e842 Mon Sep 17 00:00:00 2001 From: Christophe Fergeau Date: Mon, 22 Jan 2024 15:33:02 +0100 Subject: [PATCH] ghactions: Trigger snyk on 'pull-request, rather than 'push' This should fix this error on PRs from dependabot: ``` Error: Workflows triggered by Dependabot on the "push" event run with read-only access. Uploading Code Scanning results requires write access. To use Code Scanning with Dependabot, please ensure you are using the "pull_request" event for this workflow and avoid triggering on the "push" event for Dependabot branches. See https://docs.github.com/en/code-security/secure-coding/configuring-code-scanning#scanning-on-push for more information on how to configure these events. ``` --- .github/workflows/snyk.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml index 6ea7530a..ac259683 100644 --- a/.github/workflows/snyk.yml +++ b/.github/workflows/snyk.yml @@ -1,5 +1,6 @@ name: Code Scanning with Snyk -on: push +on: pull_request + types: [opened, reopened] jobs: security: runs-on: ubuntu-latest