Github Reusable Workflow - being able to fail to job by a minimum severity

[fingeromer]

Hi, is there a way to set a minimum CVSS for failing the reusable PR scanner workflow? For example, new package with CVE of 2.1 CVSS, only print log, but won't fail the step.

[oliverchang]

Extending on this, it might make sense to keep this consistent with the prioritisation mechanisms for guided remediation: https://github.com/google/osv-scanner/issues/352

• minimum severity
• maximum dependency depth
• dev vs non dev

[github-actions[bot]]

This issue has not had any activity for 60 days and will be automatically closed in two weeks

[github-actions[bot]]

Automatically closing stale issue