Github Reusable Workflow - being able to fail to job by a minimum severity

[fingeromer]

Hi, is there a way to set a minimum CVSS for failing the reusable PR scanner workflow?
For example, new package with CVE of 2.1 CVSS, only print log, but won't fail the step.

[oliverchang]

Extending on this, it might make sense to keep this consistent with the prioritisation mechanisms for guided remediation: #352

• minimum severity
• maximum dependency depth
• dev vs non dev

[github-actions]

This issue has not had any activity for 60 days and will be automatically closed in two weeks

[github-actions]

Automatically closing stale issue