Infra: Limit CVE checks run on main

[Haarolean]

It shouldn't get triggered if unrelated to the app files are changed, like infra

[Haarolean]

@Brijeshthummar02 perhaps you'd be interested in this one

[yeikel]

Hi @Haarolean

What files are you looking to exclude?

I personally disagree with this issue. As we discussed previously, I think it should always run it and raise awareness with every change

[Haarolean]

Hi @Haarolean

What files are you looking to exclude?

I personally disagree with this issue. As we discussed previously, I think it should always run it and raise awareness with every change

Not sure it adds any value if run on a change to, say, gradle wrapper properties file, or something.

[yeikel]

Hi @Haarolean

What files are you looking to exclude?

I personally disagree with this issue. As we discussed previously, I think it should always run it and raise awareness with every change

Not sure it adds any value if run on a change to, say, gradle wrapper properties file, or something.

The value is awareness

For example, even if in one particular week we only work on the gradle file, we still want to know that there is a vulnerability that needs attention