"Finding Vulnerabilities" step too long

[brianamarie]

"Finding Vulnerabilities" is just a lot of steps in the action phase. Is it too much? How could we break it up?

For adding a .gitignore, we have the bot create a branch. Should/could we do the same thing here, and have the bot create a branch, point out the part of the file that should be edited, and then post the instructions in the PR?

What if user's instruction was to check the dependencies, comment the proper version, and then the bot opened the the PR and the instructions were for the user to edit the file?

[brianamarie]

What if user's instruction was to check the dependencies, comment the proper version, and then the bot opened the the PR and the instructions were for the user to edit the file?

As I go through the course again, this feels like the right amount in each step.