Support merge_group trigger

[actions]

Support merge_group trigger

[tenjaa]

I don't know where I got the workaround from but this in the end worked for me:

    - uses: actions/dependency-review-action@v2
      with:
        allow-licenses: MIT, Apache-2.0, ISC, BSD-2-Clause, 0BSD, NOASSERTION
        base-ref: ${{ github.event.pull_request.base.sha || 'main' }}
        head-ref: ${{ github.event.pull_request.head.sha || github.ref }}

[febuiles]

@tenjaa thanks for opening an issue apologies it took almost a month to get to it.

After reading the docs it looks like we'd need to modify a bit how we fetch the base and head refs if the event is of type merge_group, we currently drop everything but pull_request and push).

[febuiles]

Thanks for the workaround example. I'm leaving this open and marked as "Good First Issue" so we can maybe get this supported as a first-class thing.