From 832f10b7f62eb46cf9abf1a0f3f035f686132331 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9sar=20Arroba?=
 <19954079+cesararroba@users.noreply.github.com>
Date: Tue, 16 Jun 2026 11:35:30 +0200
Subject: [PATCH] ci: narrow osv-scanner gate to CRITICAL on v5.30 (backport
 #11580) (#11616)

---
 .github/actions/osv-scanner/action.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/actions/osv-scanner/action.yml b/.github/actions/osv-scanner/action.yml
index 4bfb5993cb..de5116fdcf 100644
--- a/.github/actions/osv-scanner/action.yml
+++ b/.github/actions/osv-scanner/action.yml
@@ -1,5 +1,5 @@
 name: 'OSV-Scanner'
-description: 'Install osv-scanner and scan a lockfile, failing on HIGH/CRITICAL/UNKNOWN severity findings. Posts/updates a PR comment with findings on pull_request events (requires pull-requests: write).'
+description: 'Install osv-scanner and scan a lockfile, failing on CRITICAL severity findings. Posts/updates a PR comment with findings on pull_request events (requires pull-requests: write).'
 author: 'Prowler'
 
 inputs:
@@ -7,9 +7,9 @@ inputs:
     description: 'Path to the lockfile to scan, relative to the repository root (e.g. uv.lock, api/uv.lock, ui/pnpm-lock.yaml).'
     required: true
   severity-levels:
-    description: 'Comma-separated severity levels that fail the scan. Default: HIGH,CRITICAL,UNKNOWN.'
+    description: 'Comma-separated severity levels that fail the scan. Default: CRITICAL.'
     required: false
-    default: 'HIGH,CRITICAL,UNKNOWN'
+    default: 'CRITICAL'
   version:
     description: 'osv-scanner release tag to install. When overriding, you MUST also override binary-sha256.'
     required: false