Requesting v1 Release Patching ::add-path Github Deprecation

[dvalentiate]

anchore/scan-action@v1 needs to be update because ::add-path has been deprecated by Github and no longer works.

This same issue has been fixed for v2, with #71 , but v1 needs to be patched and released because #55 is preventing some projects from upgrading to v2.

[gary-caylent]

Encountered the same issue today and as using a custom policy with v1 it would appear cant simply use v2 of the action

[dvalentiate]

I've forked this project and implemented a v1_release branch based on this project's v1.0.9 tag. I merged this PR https://github.com/bluedrop-learning-networks/scan-action/pull/1/files into that. I've confirmed that this fixes the deprecated ::add-path issue.

I tried to create a PR against this project but it needs to have a v1 branch to base the PR on. v1_release or similar.

Otherwise if this project just wants to continue with tags alone, I believe the following would get the job done. Please note that I'm unfamiliar with this project's process and that I'm just trying to provide a complete example in hopes it makes it more likely this change gets implemented :-) :

git checkout v1
echo 'diff --git a/package.json b/package.json
index feec444..94a37dc 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "anchore-scan-action",
-  "version": "1.0.2",
+  "version": "1.0.10",
   "description": "Anchore image scan github action",
   "main": "index.js",
   "directories": {
@@ -28,13 +28,13 @@
   },
   "homepage": "https://github.com/anchore/anchore-scan-action#readme",
   "dependencies": {
-    "@actions/core": "^1.2.4",
+    "@actions/core": "^1.2.6",
     "@actions/exec": "^1.0.4",
-    "@actions/tool-cache": "^1.5.5",
-    "lodash": "^4.17.19"
+    "@actions/tool-cache": "^1.6.0",
+    "lodash": "^4.17.20"
   },
   "devDependencies": {
-    "@zeit/ncc": "^0.20.5",
+    "@vercel/ncc": "^0.24.1",
     "eslint": "^6.8.0",
     "husky": "^3.1.0",
     "jest": "^25.5.4"
' | git apply
npm i
npm run build
git add package.json packages-lock.json dist/index.js
git commit -m "update dependencies to fix deprecated github actions add-path"
git tag v1.0.10
git push origin v1.0.10
git tag -f v1
git push -f origin v1

[zhill]

Thanks for the feedback! We generally aren't planning to continue support for v1, but since that fix is for a security issue I think we can make an exception and get v1 tag updated but built from a v1 branch instead of main.

[alfredodeza]

This has been addressed as part of the v1 tag. A deprecation warning is now present to indicate that we are no longer supporting this version and users should upgrade to v2.

d391859