Suggestion: be less prescriptive on where UPD-3 happens

[joshuagl]

Is it strictly required that UPD-3 be part of a PR workflow, or is it better to make this requirement more general so that developers are made aware of known vulnerabilties and updates which can remediate them through one or more methods as appropriate for their workflow?

I.e., if notifications are triggered during CI/CD, or as email, or ...

[adriandiglio]

If we changed the requirement to instead read as follows: "Display OSS vulnerabilities in Pull Requests (PRs)", would that meet your needs? This would allow teams to surface vulnerabilities in different ways, so long as they are surfaced at PR time.

[joshuagl]

What about changing it to "Display OSS vulnerabilities in developer contribution flow (i.e. Pull Requests)" ?

That keeps PRs as the primary recommended mechanism, but allows for slightly different (often older or non-git) workflows where the information might be surfaced to a developer by a CI system or otherwise.

I think the important thing is that this information is surfaced to developers before the change is merged?

[adriandiglio]

This was address in PR #57