Document how to properly use `base-ref` about dependency-review-action HOT 6 CLOSED

@nedbat Hi, and thanks for the feedback. This feature was added so people could perform static runs with hardcoded values, so I have not seen it being used as part of pulls alone. What happens if you use the before and after values provided by the pull event?

from dependency-review-action.

Sorry, to be clear, the two lines I put in seem to work well. It compares master to the tip of the push, so it's checking what will happen when the branch is merged, unless I've misunderstood.

I guess I could also use ${{ github.event.base_ref }} and ${{ github.event.before }} to check what the push is actually changing.

In either case, a bit of doc in the readme about how to use the setting would remove some uncertainty.

from dependency-review-action.

@nedbat thanks, and apologies for the misunderstanding, I'm glad it was working! A rewrite of the README is in the works (it's too long atm), if you want to help out feel free to open a PR with an example for these options.

from dependency-review-action.

@febuiles Hi, I don't think I've got my settings right yet. On a pull request across forks, I got this result:

Run actions/dependency-review-action@v3
  with:
    base-ref: master
    head-ref: xml_duplicate_fix
    repo-token: ***
    fail-on-severity: low
    fail-on-scopes: runtime
Error: Bad Request

As above, I am using:

          base-ref: ${{ github.event.pull_request.base.ref || 'master' }}
          head-ref: ${{ github.event.pull_request.head.ref || github.ref }}

I guess I need something to properly deal with forks?

from dependency-review-action.

This seems to have worked:

          base-ref: ${{ github.event.pull_request.base.sha || 'master' }}
          head-ref: ${{ github.event.pull_request.head.sha || github.ref }}

from dependency-review-action.

@nedbat that's very interesting! The API for Dependency Review only supports changes against the default branch (usually master or main), which is why base has to be part of that branch.

from dependency-review-action.