Recently (beginning 2/19/2024?) our PRs started getting comments added with the results of the Dependency Review even without specifying the comment-summary-in-pr option. It behaves as if the default for this setting is always instead of the documented never.

Our workflow job is defined as:

      - name: Dependency Review
        uses: actions/dependency-review-action@v4
        with:
          fail-on-severity: high
          fail-on-scopes: runtime, development
          retry-on-snapshot-warnings: true

And the output from the job is:

Run actions/dependency-review-action@v4
  with:
    fail-on-severity: high
    fail-on-scopes: runtime, development
    retry-on-snapshot-warnings: true
    repo-token: ***
    retry-on-snapshot-warnings-timeout: 120
    warn-only: false