build(deps): Bump SeanLF/still_active-action from 0.3.0 to 0.4.0 in the actions group

[dependabot]

Bumps the actions group with 1 update: SeanLF/still_active-action.

Updates SeanLF/still_active-action from 0.3.0 to 0.4.0

Release notes

Sourced from SeanLF/still_active-action's releases.

v0.4.0 — still_active 3.0 inputs

Catches the action up to still_active 3.0.0, released today.

New inputs

input	what it does
sbom	Audit a CycloneDX SBOM cross-ecosystem (npm, PyPI, Cargo, Go, Maven, NuGet) instead of a Gemfile
fail-if-critical	Exit 1 on critical/archived activity only, ignoring the stale/warning band
fail-if-deprecated	Exit 1 when a dependency's maintainer has declared it deprecated
fail-if-poison	Exit 1 on a dormant package capping a dependency below its latest major
fail-if-language-ceiling	Exit 1 on a pin that strands you on an EOL runtime
ecosystems-email	Join the ecosyste.ms polite pool for tokenless runs

All of these previously needed extra-args. fail-if-critical had never been exposed at all.

sbom + cyclonedx now produces an enriched SBOM

The input, re-annotated with still_active's maintenance signals as still_active:-namespaced component properties and the advisories as CycloneDX vulnerabilities, so it can be fed to Dependency-Track. Every component keeps the PURL it arrived with, so whatever matched your input matches the output.

Setting two output modes no longer fails silently

sarif and cyclonedx together used to drop one with no message, no file and a green build. The action now says which mode it is using and which it is ignoring.

Heads-up for anyone on the default

version defaults to latest, which now resolves to still_active 3.0.0. A previously-green run can go red: fail-if-vulnerable now fails closed on unscored advisories, and tokenless runs resolve real repository signals instead of degrading to unknown. See Upgrading to 3.0. Pin version: to upgrade deliberately.

Commits

• 285c9c2 fix: catch the action up to still_active 3.0 (sbom+cyclonedx, fail-if-depreca...
• ab30570 feat: expose fail-if-critical, which the action never wired up (#9)
• 3ad3f2e feat: expose still_active 3.0's inputs instead of extra-args (#7)
• 83f9c43 v3 coordination: opt-in cvss-suite toggle + document still_active 3.0 fail-cl...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions