From 10b07540c0024bd906853643a45af2482125d08c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 14 Aug 2026 18:09:52 +0900 Subject: [PATCH 1/2] ci: update OSV reusable workflow to v2.5.0 --- .github/workflows/osvscanner.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/osvscanner.yml b/.github/workflows/osvscanner.yml index 806c8086..d0dab8c7 100644 --- a/.github/workflows/osvscanner.yml +++ b/.github/workflows/osvscanner.yml @@ -17,7 +17,7 @@ jobs: if: github.event_name == 'pull_request' # Companion SCA lane for manifest evidence. Central .github still owns the # required review/security/scheduler workflows. - uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@3a7550f43ba5b58905a821ce3a0ed24c4858b3f4 # v2.3.8 + export-results gate + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@f4cfcc01edc9c8b756a9b873b7a623ca674da51e # v2.5.0 + export-results gate permissions: actions: read contents: read From 6550f4f6fa2137471295cd84e242d2e2ae39c936 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 15 Aug 2026 16:16:27 +0900 Subject: [PATCH 2/2] fix(ci): pin exact OSV Scanner v2.5.0 action --- .github/workflows/osvscanner.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/osvscanner.yml b/.github/workflows/osvscanner.yml index d0dab8c7..96ca93a2 100644 --- a/.github/workflows/osvscanner.yml +++ b/.github/workflows/osvscanner.yml @@ -17,7 +17,7 @@ jobs: if: github.event_name == 'pull_request' # Companion SCA lane for manifest evidence. Central .github still owns the # required review/security/scheduler workflows. - uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@f4cfcc01edc9c8b756a9b873b7a623ca674da51e # v2.5.0 + export-results gate + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@8deb546fdb875b9996d27d4950be7312dac076a1 # v2.5.0 permissions: actions: read contents: read