dependency-review-action, specifies a pre-release version

[npushkarskii]

As suggested in actions/dependency-review-action#670 (comment) , using the specific pre-release version of the action might resolve the issue with licenses.

In the doc repo, we've been having many failed builds because of it.

Example of this issue:
https://github.com/coveo/doc_jekyll-public-site/actions/runs/8909727612/job/24467591900

[npushkarskii]

@dblanchette I'm not sure what's causing all the tests here to fail 😢 Initially, there was a pipe character in the PR's title and I thought it messed with the paths; removing it didn't fix anything, though.

[npushkarskii]

@dblanchette @jonapich @sysboy
Hey guys, just a kind follow-up :) Thank you!

[npushkarskii]

@dblanchette @jonapich @sysboy
A gentle reminder comes again :)

[JPLachance]

Hello,

It's great that GitHub are finally looking at this issue and finally working on making our config file simpler, scalable.

While I understand that we might want to start using that pre-release version yesterday, I'm a bit against using a non-official non-released version of the action that would use a non-protected branch of that GitHub project.

One mistake in that GitHub project non-protected branch and the CI of Coveo would stop working for all Coveo projects.

I would wait for the official V5 release.

Now, if you want to take the risk in your projects, use the non-official version of the Action, nothing prevents you from doing it. Create your custom workflow file and simply stop invoking this workflow.

Does that make sense?

[npushkarskii]

@JPLachance Hey, thanks a lot for explaining your point of view. I expected that merging this PR would be undesirable because of the risks, but still, these were just MY thoughts. I wanted to hear from the maintainers, and now I've heard from you :)

I'll close this PR then.