FYI: I adjusted the vulnerability scanning workflow after discussing with Mattias & Søren. If your PR branch now lives on grails-core & is up-to-date with my changes, you can now add the label "vulnerability scan" and the PR will be scanned for vulnerabilities.
The scan job will then post the results to a comment in the PR. If you add the label to a branch on a third party repo, it will inform you it can't scan. It should auto-skip any PR that isn't labelled too. Please use this label for major updates so we can ensure we don't introduce a CVE. As a reminder, VulnerabilityScanPlugin.groovy is where we "mark" known CVEs that may not be fixed yet. Please update appropriately and add a reason so we know when we can remove it. Eventually, we'll want to make use of Apache Magpie to auto apply this label. -James
