don't set output on every run

Adding stale checks to issues

.github/workflows/stale.yaml

@@ -1,6 +1,7 @@
-name: Close stale PRs
+name: Close stale PRs and Issues
 
 permissions:
+  issues: write
   pull-requests: write
 
 on:
@@ -12,14 +13,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/stale@v9.0.0
-      name: Clean up stale PRs
+      name: Clean up stale PRs and Issues
       with:
         stale-pr-message: "👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the `Keep` label to hold stale off permanently, or do nothing. If you do nothing, this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details."
         stale-pr-label: "Stale"
         exempt-pr-labels: "Keep" # a "Keep" label will keep the PR from being closed as stale
         days-before-pr-stale: 180 # when the PR is considered stale
         days-before-pr-close: 15 # when the PR is closed by the bot, 
-        days-before-issue-stale: -1 # prevents issues from being tagged by the bot
-        days-before-issue-close: -1 # prevents issues from being closed by the bot
+        days-before-issue-stale: 180 # prevents issues from being tagged by the bot
+        days-before-issue-close: 15 # prevents issues from being closed by the bot
         exempt-assignees: 'advanced-security-dependency-graph'
         ascending: true

dist/index.js

@@ -56,15 +56,10 @@ const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
 const octo = new retryingOctokit(githubUtils.getOctokitOptions(core.getInput('repo-token', { required: true })));
 // Comment Marker to identify an existing comment to update, so we don't spam the PR with comments
 const COMMENT_MARKER = '<!-- dependency-review-pr-comment-marker -->';
-function commentPr(summary, config) {
+function commentPr(summary) {
     return __awaiter(this, void 0, void 0, function* () {
         const commentContent = summary.stringify();
         core.setOutput('comment-content', commentContent);
-        if (config.comment_summary_in_pr !== 'always' &&
-            config.comment_summary_in_pr === 'on-failure' &&
-            process.exitCode !== core.ExitCode.Failure) {
-            return;
-        }
         if (!github.context.payload.pull_request) {
             core.warning('Not in the context of a pull request. Skipping comment creation.');
             return;
@@ -653,7 +648,11 @@ function run() {
             }
             summary.addScannedDependencies(changes);
             printScannedDependencies(changes);
-            yield (0, comment_pr_1.commentPr)(core.summary, config);
+            if (config.comment_summary_in_pr === 'always' ||
+                (config.comment_summary_in_pr === 'on-failure' &&
+                    process.exitCode === core.ExitCode.Failure)) {
+                yield (0, comment_pr_1.commentPr)(core.summary);
+            }
         }
         catch (error) {
             if (error instanceof request_error_1.RequestError && error.status === 404) {

docs/examples.md

@@ -189,7 +189,8 @@ jobs:
           fail-on-severity: critical
           deny-licenses: LGPL-2.0, BSD-2-Clause
       - name: 'Report'
-        if: always()  # make sure this step runs even if the previous failed
+        # make sure this step runs even if the previous failed
+        if: ${{ failure() && steps.review.conclusion == 'failure' }}
         shell: bash
         env:
           comment: ${{ steps.review.outputs.comment-content }}

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "dependency-review-action",
-  "version": "4.1.1",
+  "version": "4.1.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "dependency-review-action",
-      "version": "4.1.1",
+      "version": "4.1.3",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.10.1",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "dependency-review-action",
-  "version": "4.1.1",
+  "version": "4.1.3",
   "private": true,
   "description": "A GitHub Action for Dependency Review",
   "main": "lib/main.js",

src/comment-pr.ts

@@ -3,7 +3,6 @@ import * as core from '@actions/core'
 import * as githubUtils from '@actions/github/lib/utils'
 import * as retry from '@octokit/plugin-retry'
 import {RequestError} from '@octokit/request-error'
-import {ConfigurationOptions} from './schemas'
 
 const retryingOctokit = githubUtils.GitHub.plugin(retry.retry)
 const octo = new retryingOctokit(
@@ -13,22 +12,11 @@ const octo = new retryingOctokit(
 // Comment Marker to identify an existing comment to update, so we don't spam the PR with comments
 const COMMENT_MARKER = '<!-- dependency-review-pr-comment-marker -->'
 
-export async function commentPr(
-  summary: typeof core.summary,
-  config: ConfigurationOptions
-): Promise<void> {
+export async function commentPr(summary: typeof core.summary): Promise<void> {
   const commentContent = summary.stringify()
 
   core.setOutput('comment-content', commentContent)
 
-  if (
-    config.comment_summary_in_pr !== 'always' &&
-    config.comment_summary_in_pr === 'on-failure' &&
-    process.exitCode !== core.ExitCode.Failure
-  ) {
-    return
-  }
-
   if (!github.context.payload.pull_request) {
     core.warning(
       'Not in the context of a pull request. Skipping comment creation.'

src/main.ts

@@ -144,7 +144,13 @@ async function run(): Promise<void> {
 
     summary.addScannedDependencies(changes)
     printScannedDependencies(changes)
-    await commentPr(core.summary, config)
+    if (
+      config.comment_summary_in_pr === 'always' ||
+      (config.comment_summary_in_pr === 'on-failure' &&
+        process.exitCode === core.ExitCode.Failure)
+    ) {
+      await commentPr(core.summary)
+    }
   } catch (error) {
     if (error instanceof RequestError && error.status === 404) {
       core.setFailed(