Stop dependency-review from commenting the benign fork-PR snapshot warning

[AndreasIgel]

Summary

Stops the dependency-review check from posting the confusing "No snapshots were found for the head SHA" warning as a comment on every PR. Fixes #212 (follow-up to #160 / #182).

Root cause / why the earlier idea doesn't work: the warning is not a failure — the check is green. It appears because for a fork PR head GitHub has only the manifest-derived dependency graph and no submitted snapshot. A submitted snapshot can't be produced for a fork PR head without building untrusted fork code with a write token (the pattern the fork-CI design deliberately avoids), and submitting on main doesn't help a PR head. So the warning can't be "fixed" by adding data — it has to be configured away.

Fix: switch comment-summary-in-pr from always to on-failure. The action only creates/updates the PR summary comment when the review actually fails (a vulnerability at/above fail-on-severity, or a denied license); snapshot warnings alone never trigger a comment. On clean PRs there is now no comment, so the benign snapshot warning stops showing up on PRs. The warning remains only in the Actions run log, and the check still runs and still fails on real issues.

   with:
-    comment-summary-in-pr: always
+    comment-summary-in-pr: on-failure   # only comment when there's a real vuln/license failure
     fail-on-severity: high
     deny-licenses: GPL-1.0-or-later, ...
-    # Snapshot dependency data can lag right after a push; retry instead of failing spuriously.
-    retry-on-snapshot-warnings: true    # counterproductive here: no submission exists, so it just wastes ~2 min

This is the standard approach for OSS projects (GitHub's own starter workflow defaults comment-summary-in-pr to never; on-failure keeps a helpful comment when it matters). Tradeoff: no "✅ No vulnerabilities" comment on clean PRs — the green check conveys that instead.

Also removes retry-on-snapshot-warnings: true (added in #182): with no submission workflow it just retries ~2 min for a snapshot that never arrives, then proceeds with the warning anyway.

Related

• dependency-review posts benign 'missing snapshots' warning; submit Maven dependency snapshots #212, Enforce severity and license gates in dependency-review workflow #160 / Enforce severity and license gates in dependency-review workflow #182

Note

A separate, optional enhancement (not in this PR) would be adding a Maven dependency submission workflow on main for fuller transitive dependency coverage in the graph/Dependabot alerts — but that is orthogonal to this warning and I left it out to keep this focused. Happy to add it if you want it.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA ff76bc1.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud