From 5c148a4212c9d499c716ab398b621fa5173f20c1 Mon Sep 17 00:00:00 2001 From: Gonzalo Diaz Date: Wed, 23 Oct 2024 14:15:19 -0300 Subject: [PATCH] [CONFIG] [Github Actions] Avoid run on "push" for dependabot triggered actions. Workflows triggered by Dependabot on the "push" event run with read-only access. Uploading Code Scanning results requires write access. To use Code Scanning with Dependabot, please ensure you are using the "pull_request" event for this workflow and avoid triggering on the "push" event for Dependabot branches. See https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#scanning-on-push for more information on how to configure these events. https://stackoverflow.com/a/57903434/6366150 --- .github/workflows/snyk-code.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/snyk-code.yml b/.github/workflows/snyk-code.yml index 1d51817..99f46d4 100644 --- a/.github/workflows/snyk-code.yml +++ b/.github/workflows/snyk-code.yml @@ -3,8 +3,11 @@ name: Snyk Code (Java gradle-jdk17) on: # yamllint disable-line rule:truthy - push: pull_request: + push: + branches: + - '**' # matches every branch + - '!dependabot/**' # excludes master workflow_dispatch: jobs: