The current security-scan-app and security-scan-container workflows are triggered on push and pull_request events. When dependabot triggers it with a push event, the resulting SARIF files can't be uploaded, due to a limitation.
From the Github Actions logs:
Warning: Workflows triggered by Dependabot on the "push" event run with read-only access. Uploading Code Scanning results requires write access. To use Code Scanning with Dependabot, please ensure you are using the "pull_request" event for this workflow and avoid triggering on the "push" event for Dependabot branches. See https://docs.github.com/en/code-security/secure-coding/configuring-code-scanning#scanning-on-push for more information on how to configure these events.
We might want to find a way to disable dependabot from triggering on such "push" events.
https://github.com/freedomofpress/dangerzone/blob/76898471e74be861505392304f8e03c2a5305a90/.github/workflows/scan.yml#L2-L8
The current
security-scan-appandsecurity-scan-containerworkflows are triggered onpushandpull_requestevents. When dependabot triggers it with apushevent, the resulting SARIF files can't be uploaded, due to a limitation.From the Github Actions logs:
We might want to find a way to disable dependabot from triggering on such "push" events.