Need the policy for critical only issyes

[karthikboncheruuvu]

@GeekMasher :

Hi ..Hope you are doing well.

i need ur suggestion on what to be used for codeql and dependabot policies to identify or break the loop for only critical issues.

we were using it as error, but it shows both critical and high..
i need only critical issues to break the loop

kindly suggest at the earliest..

[Pradoxzon]

The 'error' level will include all 'error', 'high', and 'critical' severity alerts by design. Could you just specify 'critical' instead of 'error' in your policy? That would limit it to only 'critical' alerts.

[GeekMasher]

@Pradoxzon is correct, you can set codescanning and dependabot severity levels to critical and it will only break on critical alerts. The default policy is the following.

The order is here.

[karthikboncheruuvu]

it works