search

actions / dependency-review-action

A GitHub Action for detecting vulnerable dependencies and invalid licenses in your PRs
MIT License
558 stars 94 forks source link

[BUG] When the report exceeds 64KB pr issue is not created since it exceeds max comment issue #779

Closed tspascoal closed 3 weeks ago

tspascoal commented 3 weeks ago

Describe the bug

The maximum size of comment is 64KB, and when a report exceeds this value the action shows a warning stating creating comment was impossible and no comment is created

To Reproduce Steps to reproduce the behavior:

  1. Use dependency review with a pr that has a big number of vulnerable dependencies on the PR
  2. Check the job logs and see the Warning: Unable to comment summary to pull-request, received error...... message

Expected behavior

If this happens, either the report should be truncated (with a warning it's not complete and make sure users check the logs or see the job summary), a a shortened version of the report should be added or just a comment stating the report was too big for the comment and that users should see the logs or job summary.

The job summary has been generated, but there is a related issue (#774 ) where the job summary wasn't created since it exceeded the maximum size of the summary (1MB)

Screenshots

Image

Action version

v4.3.2

Examples

no public repo with an example

Additional context Add any other context about the problem here.

elireisman commented 3 weeks ago

👋 @tspascoal this should be fixed in https://github.com/actions/dependency-review-action/pull/767 which will be included in the next release. There are a few more PRs we'd like to land first, but that release should be coming in the next few days.