update doc

README.md

@@ -78,12 +78,13 @@ Configure this action by either inlining these options in your workflow file, or
 | `allow-dependencies-licenses`\* | Contains a list of packages that will be excluded from license checks.                                                                                                            | Any package(s) in [purl](https://github.com/package-url/purl-spec) format    | none          |
 | `base-ref`/`head-ref`           | Provide custom git references for the git base/head when performing the comparison check. This is only used for event types other than `pull_request` and `pull_request_target`.  | Any valid git ref(s) in your project                                         | none          |
 | `comment-summary-in-pr`         | Enable or disable reporting the review summary as a comment in the pull request. If enabled, you must give the workflow or job permission `pull-requests: write`.                 | `true`, `false`                                                              | `false`       |
-| `warn-only`                     | Enable or disable the action to fail, when set to `true` it will override the  `fail-on-severity` and action will not fail.                                                       | `true`, `false`                                                              | `false`       |
+| `warn-only`+                   | Enable or disable the action to fail, when set to `true` it will override the  `fail-on-severity` and action will not fail.                                                       | `true`, `false`                                                              | `false`       |
 
 \*not supported for use with GitHub Enterprise Server
 
 †will be supported with GitHub Enterprise Server 3.8
 
++when `warn_only` is set to `true`, all vulnarabilities, independently of the severity, will be reported as warnings and the action will not fail.
 
 
 ### Inline Configuration

__tests__/test-helpers.ts

@@ -18,7 +18,8 @@ export function clearInputs(): void {
     'CONFIG-FILE',
     'BASE-REF',
     'HEAD-REF',
-    'COMMENT-SUMMARY-IN-PR'
+    'COMMENT-SUMMARY-IN-PR',
+    'WARN-ONLY',
   ]
 
   // eslint-disable-next-line github/array-foreach

dist/index.js

@@ -505,11 +505,10 @@ function run() {
             const failOnSeverityParams = config.fail_on_severity;
             const warnOnly = config.warn_only;
             let minSeverity = 'low';
+            // If failOnSeverityParams is not set or warnOnly is true, the minSeverity is low, to allow all vulnerabilities to be reported as warnings
             if (failOnSeverityParams && !warnOnly) {
                 minSeverity = failOnSeverityParams;
             }
-            // debug
-            core.debug(`Config: \n\t ${JSON.stringify(config, null, 2)}`);
             const scopedChanges = (0, filter_1.filterChangesByScopes)(config.fail_on_scopes, changes);
             const filteredChanges = (0, filter_1.filterAllowedAdvisories)(config.allow_ghsas, scopedChanges);
             const vulnerableChanges = (0, filter_1.filterChangesBySeverity)(minSeverity, filteredChanges).filter(change => change.change_type === 'added' &&

src/main.ts

@@ -38,15 +38,13 @@ async function run(): Promise<void> {
     }
 
     const failOnSeverityParams = config.fail_on_severity
-    const warnOnly = config.warn_only 
+    const warnOnly = config.warn_only
     let minSeverity: Severity = 'low'
+    // If failOnSeverityParams is not set or warnOnly is true, the minSeverity is low, to allow all vulnerabilities to be reported as warnings
     if (failOnSeverityParams && !warnOnly) {
       minSeverity = failOnSeverityParams
     }
 
-    // debug
-    core.debug(`Config: \n\t ${JSON.stringify(config, null, 2)}`)
-
     const scopedChanges = filterChangesByScopes(config.fail_on_scopes, changes)
     const filteredChanges = filterAllowedAdvisories(
       config.allow_ghsas,
@@ -84,11 +82,7 @@ async function run(): Promise<void> {
 
     if (config.vulnerability_check) {
       summary.addChangeVulnerabilitiesToSummary(vulnerableChanges, minSeverity)
-      printVulnerabilitiesBlock(
-        vulnerableChanges,
-        minSeverity,
-        warnOnly
-      )
+      printVulnerabilitiesBlock(vulnerableChanges, minSeverity, warnOnly)
     }
     if (config.license_check) {
       summary.addLicensesToSummary(invalidLicenseChanges, config)