remote config file setting not getting set/used about dependency-review-action HOT 2 CLOSED

Hi @Gomer05. Thank you for the report. I have been able to reproduce it. Here's the failing log: https://github.com/future-funk/studious-giggle/actions/runs/4341088504/jobs/7580269884. I'll take a look at the soon.

Reproduction steps

I created a new repo. Its config file points to future-funk/miniature-waddle , the repo containing the actual configuration.

Expected behavior

The output of the run containing fail-on-severity: critical, the value specified in the external config.

Current behavior
We're outputting (and scanning) the action's default values (fail-on-severity: low).

from dependency-review-action.

@Gomer05 This should be fixed now in the main branch, and will make it to the next release, thanks again for the report!

If you want to test it works, you can replace the v3 for main in your workflow file, e.g.

        uses: actions/dependency-review-action@main

Something to note: The documentation was updated with some mistakes in another PR. I've changed it back, it but it's not super clear so here it goes again: key names in external config files should use underscores (_), not dashes (-). This means that the external configuration file keys should read like fail_on_severity, not fail-on-severity. I'll get back to fixing this in another PR (unless you want to open one first! 😅)

from dependency-review-action.