The order of the commands matter, if cve command is in the middle, the rest of the commands will not be executed in case of failure.
In the first example , only the first 2 commands are executed, the error stops it.
id: docker-scout-scan
uses: docker/scout-action@v1
with:
command: quickview,cves,sbom,recommendations
exit-code: true
In the second example the behaviour is correct and all comands run
id: docker-scout-scan
uses: docker/scout-action@v1
with:
command: quickview,sbom,recommendations,cves
exit-code: true
This is somehow not transparent or obvious to the users.