Skip to content
This repository was archived by the owner on Apr 15, 2026. It is now read-only.

ci: bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 2.3.3 to 2.3.5 #36

Merged
ethanolivertroy merged 1 commit into from
Apr 15, 2026
Merged

ci: bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 2.3.3 to 2.3.5 #36

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/osv-scanner.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,4 +26,4 @@ jobs:
actions: read
security-events: write
contents: read
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@c5996e0193a3df57d695c1b8a1dec2a4c62e8730" # v2.3.3
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@c51854704019a247608d928f370c98740469d4b5" # v2.3.5
Copy link
Copy Markdown

@devin-ai-integration devin-ai-integration bot Mar 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Inconsistent OSV Scanner version: scan-pr still pinned to v2.3.3 while scan-scheduled updated to v2.3.5

The PR updates the scan-scheduled job's commit hash to c51854704019a247608d928f370c98740469d4b5 (v2.3.5) but leaves the scan-pr job at c5996e0193a3df57d695c1b8a1dec2a4c62e8730 (v2.3.3) on line 21. Both jobs were previously pinned to the same v2.3.3 commit, indicating they should be kept in sync. This means PR scans will run a different (older) version of the scanner than push/scheduled scans, which could lead to inconsistent vulnerability detection results between the two jobs.

Prompt for agents 
In .github/workflows/osv-scanner.yml, update line 21 (the scan-pr job) to also use the v2.3.5 commit hash, keeping both jobs consistent:

Line 21 should change from:
  uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@c5996e0193a3df57d695c1b8a1dec2a4c62e8730" # v2.3.3
to:
  uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@c51854704019a247608d928f370c98740469d4b5" # v2.3.5

This keeps both the scan-pr and scan-scheduled jobs pinned to the same version of the OSV scanner action.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.