Snyk error on merging dependabot PRs can be fixed

[swcurran]

A recent dependabot PR got a Synk error because of a lack of permissions on the GHA for dependabot. Guidance is given in the error code on how to prevent the error. I’m not a GHA pro, so I’m opening this issue in hopes that someone with greater GHA knowledge can review the guidance and correct the issue.

Here is what was printed about the error:

Error: Workflows triggered by Dependabot on the "push" event run with read-only access. Uploading Code Scanning results requires write access. To use Code Scanning with Dependabot, please ensure you are using the "pull_request" event for this workflow and avoid triggering on the "push" event for Dependabot branches. See https://docs.github.com/en/code-security/secure-coding/configuring-code-scanning#scanning-on-push for more information on how to configure these events.