Support merge_group trigger

[tenjaa]

When using this action with the new merge queue feature, I get the following error:

Error: Both a base ref and head ref must be provided, either via the `base_ref`/`head_ref` config options, or by running a `pull_request`/`pull_request_target` workflow.

It would be awesome, if this action can support the merge_group trigger out of the box.

[febuiles]

@tenjaa thanks for opening an issue apologies it took almost a month to get to it.

After reading the docs it looks like we'd need to modify a bit how we fetch the base and head refs if the event is of type merge_group, we currently drop everything but pull_request and push).

[tenjaa]

I don't know where I got the workaround from but this in the end worked for me:

    - uses: actions/dependency-review-action@v2
      with:
        allow-licenses: MIT, Apache-2.0, ISC, BSD-2-Clause, 0BSD, NOASSERTION
        base-ref: ${{ github.event.pull_request.base.sha || 'main' }}
        head-ref: ${{ github.event.pull_request.head.sha || github.ref }}

[febuiles]

Thanks for the workaround example. I'm leaving this open and marked as "Good First Issue" so we can maybe get this supported as a first-class thing.