* Add by-cve option to action options

Signed-off-by: too-gee <[email protected]>

* chore: update audit to use npm-better-audit
* chore: modify workflow to use new audit script

Signed-off-by: Christopher Phillips <[email protected]>

---------

Signed-off-by: Keith Zantow <[email protected]>
Signed-off-by: too-gee <[email protected]>
Signed-off-by: Christopher Phillips <[email protected]>
Co-authored-by: Keith Zantow <[email protected]>
Co-authored-by: Christopher Phillips <[email protected]>

Signed-off-by: GitHub <[email protected]>
Co-authored-by: kzantow <[email protected]>

Signed-off-by: Christopher Phillips <[email protected]>

…low (#240)

Signed-off-by: Mykhailo Kuzmich <[email protected]>

While updating the action with a new grype version npm run audit
fails because of an issue with semver being vulnerable.
https://github.com/anchore/scan-action/actions/runs/6479148648/job/17592137397?pr=236

The upgrade of semver is also failing, so the action is stuck with
an old grype version.

This commit has an upgraded semver version and a recreated index.js

Signed-off-by: Gian Carlo Pace <[email protected]>

Signed-off-by: Will Murphy <[email protected]>

* chore(deps): update Grype to v0.73.2

Signed-off-by: GitHub <[email protected]>

* remove snapshot test; assert only valid SARIF

Signed-off-by: Will Murphy <[email protected]>

* make cmd arg assertions aware of debug

Signed-off-by: Will Murphy <[email protected]>

* put bundler vuln back from GHSA

Signed-off-by: Will Murphy <[email protected]>

---------

Signed-off-by: GitHub <[email protected]>
Signed-off-by: Will Murphy <[email protected]>
Co-authored-by: kzantow <[email protected]>
Co-authored-by: Will Murphy <[email protected]>

Signed-off-by: GitHub <[email protected]>
Co-authored-by: willmurphyscode <[email protected]>

* chore: bump jest timeout

We're seeing this timeout triggered in CI.

Signed-off-by: Will Murphy <[email protected]>

* bump timeout in remaining tests

Signed-off-by: Will Murphy <[email protected]>

* chore: only run push tests on main

Otherwise, we'd run tests twice for each PR; once because it was a PR, and once
because someone pushed to a branch.

Signed-off-by: Will Murphy <[email protected]>

* chore: even higher jest timeout

Signed-off-by: Will Murphy <[email protected]>

* chore: install grype ahead of tests

Signed-off-by: Will Murphy <[email protected]>

* chore: comment test timeout

Signed-off-by: Will Murphy <[email protected]>

---------

Signed-off-by: Will Murphy <[email protected]>