Since the vulnerability scan doesn't distinguish between vulnerabilities added by the PR and those coming from vulnerability updates, PRs are regularly blocked because of unrelated vulnerabilities. Arguably this is desirable for important vulnerabilities since it forces them to be handled; but other vulnerabilities shouldn't block PRs.
This changes the fail threshold to high, so that only vulnerabilities with severity high or critical will block the build.
Since the vulnerability scan doesn't distinguish between vulnerabilities added by the PR and those coming from vulnerability updates, PRs are regularly blocked because of unrelated vulnerabilities. Arguably this is desirable for important vulnerabilities since it forces them to be handled; but other vulnerabilities shouldn't block PRs.
This changes the fail threshold to high, so that only vulnerabilities with severity high or critical will block the build.