ci: add security scans
Metadata
Current evaluation
Closed unmerged in favor of Starflow-based CI security scanning; #1924 landed the workflow, and #2027 later completed the explicit Starflow migration.
Resolution: closed superseded
Reason: The maintainer closed the PR unmerged, stating that the scans would move into canonical/starflow and that a separate PR would use that version. The replacement workflow merged in charmcraft#1924 as 5634ecb1, followed by the Starflow migration in #2027 as ad40ba4d.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Adds two security scanning items:
1. A local dependencies security scan using trivy and osv
2. A (currently disabled) remote security scan using the Canonical security scanning API
Snap build error is fixed in #1916
This is the applications version. Compare to the libraries version at https://github.com/canonical/craft-platforms/pull/52
Once approval is provided here, I will upstream to Starbase and reproduce on our other applications.
NOTE: The Starbase version will be commented out below the libraries version, with a note that applications need to switch which version is commented.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Closed unmerged in favor of Starflow-based CI security scanning; #1924 landed the workflow, and #2027 later completed the explicit Starflow migration. | |
| stealth/space-bunny-alpha | — | closed superseded | Closed unmerged in favor of Starflow-based scans; craft-platforms#55 merged, and charmcraft#1924 later added the security-scan workflow in 5634ecb1. | |
| stealth/space-bunny-alpha | — | closed superseded | Closed unmerged in favor of a Starflow-based implementation, subsequently merged as canonical/craft-platforms#55. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without merging. The CI security scanning changes are being redirected to the canonical/starflow repository. A separate pull request will implement the updated starflow version instead. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed and superseded. The author redirected the CI security scan additions to canonical/starflow and will open a separate pull request there using the starflow version. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/charmcraft#2027
(confidence 99%)
Merged the later switch to Starflow for policy and security scans in commit ad40ba4d.
-
Superseded By:
canonical/charmcraft#1924
(confidence 95%)
Merged the replacement CI security-scan workflow in commit 5634ecb1.
-
Superseded By:
canonical/craft-platforms#55
(confidence 88%)
Merged the corresponding Starflow-based automatic security-scan implementation.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #55 ci: automatic security scans | craft-platforms | merged | Merged PR #55 added an automated Starflow-based security scan workflow for the project. | |
| #52 ci: automatic security scans | craft-platforms | closed | Security scanning moved to canonical/starflow; unmerged PR #52 was superseded by merged PR #55 in commit 06de25b. | |
| #573 ci: update usage of starflow security scanner | starbase | merged | PR #573 by lengau merged into main (commit c4133af) with 2 approvals and all CI green. Bumped the python-scans job in policy.yaml to newest starflow security-scanner options, adding an osv-scanner.toml placeholder and exclude paths (+7/-1, 2 files). | |
| #2027 build(ci): use starflow for policy and security scans | charmcraft | merged | Merged PR #2027 as ad40ba4d (implementation bdc9a0a1), switching CI policy and security scans to Starflow after two approvals and a rebase onto main. | |
| #1924 ci: add security scan workflow | charmcraft | merged | Merged #1924 in commit 5634ecb1, adding the CI security-scan workflow after syncing canonical/craft-archives#128; two reviewers approved it. | |
| #56 ci: add security scanning workflow | craft-grammar | merged | Merged security-scanning CI workflow via PR #56, recorded in commit a6f1a1d. | |
| #861 ci: use starflow policy checker | craft-parts | closed | Closed unmerged; Starflow policy-scanner work later landed in PR #573 via commit c4133af4. | |
| #14 feat: golang security scanner | starflow | closed | Go security scanner proposal was closed unmerged and superseded by canonical/starflow#9, which added the workflow in commit 5ff0e00. | |
| #5068 ci: add security scan | snapcraft | merged | Merged PR #5068 in commit 040b66c00, adding CI security scanning across six files after approval by two reviewers. | |
| #128 ci: add security scan workflow | craft-archives | merged | Merged security-scan workflow in canonical/craft-archives#128 via commit 70b7abb, adding automated security scanning to CI. |