version tagging should follow a policy about dependency-review-action HOT 5 CLOSED

@jku Thanks for the links! We had an old branch called v1 which I removed while investigating the tags you mentioned, I'm guessing it was picking up the branch instead of the tag name. I'm closing this issue, but please re-open it if you have more comments or if it pops up again.

from dependency-review-action.

uses: actions/dependency-review-action@v1

This is what the README suggests so it seems likely that most users of this action are using the initial commit.

from dependency-review-action.

Hi @jku. What you describe is the expected behavior. Are you getting v1 (initial commit) runs when you do @v1 in your YAML file? I might've missed something when tagging releases, but I think right now they both point to the same one:

$ git tag --points-at a9c83d3
v1
v1.0.2

from dependency-review-action.

right now they match. Two hours ago, they did not. I was looking at the web UI when filing this but e.g. https://github.com/theupdateframework/python-tuf/runs/6401971278?check_suite_focus=true is an example run from a few weeks ago that used v1 and ended up using the initial commit.

from dependency-review-action.

Here is an example from two hours ago that used v1 and ended up running the initial commit: https://github.com/vmware-tanzu/community-edition/runs/6753289582?check_suite_focus=true

So it looks to me like someone just fixed the tag silently today

from dependency-review-action.