← Back to issue list

ci: exclude Spread tests from OSV dependency scans

View original Github issue

Metadata

Project
charmcraft
Number
#2913
Type
pull request
State
closed
Author
copilot-swe-agent
Labels
—
Created
Updated
Closed

Current evaluation

PR #2913 to exclude tests/spread from OSV scans was closed without merging; CI checks (lint, conventional commits, OSV-scanner) were still failing at closure.

Resolution: closed stale

Reason: The PR was closed while CI checks were still failing (lint / files, conventional commits, and Security scan / OSV-scanner). Despite approval from 3 reviewers, the author did not resolve the failing checks before closure.

Evaluated by: mr-cal-bot

No scores available.

Issue body

The failing OSV job reports vulnerable dependencies in Spread test fixtures. Exclude `tests/spread` from the recursive source scan as requested. - **Configuration:** Add `tests/spread` to the existing `osv-exclude-paths` list alongside `docs`. - **Scope:** Preserve project dependency scanning and advisory settings. Findings in exported project dependencies remain and may still fail the job.

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.6-35b-a3b — closed stale PR #2913 to exclude tests/spread from OSV scans was closed without merging; CI checks (lint, conventional commits, OSV-scanner) were still failing at closure.
~deepseek/deepseek-pro-latest
Impact: 35
Quick Win: 20
Complexity: 5
Confidence: 78
Actionability: 60
needs review Adds tests/spread to OSV exclude paths in the policy workflow to stop dependency scan findings in test fixtures; approved by 3 reviewers but still failing lint/files, PR title, and OSV-scanner checks.
~deepseek/deepseek-pro-latest
Impact: 25
Quick Win: 8
Complexity: 10
Confidence: 70
Actionability: 35
keep open Adds tests/spread to osv-exclude-paths in policy.yaml to exclude Spread test fixtures from OSV scans. Approved by 2 reviewers but CI failing on lint, PR title check, and OSV-scanner.
~deepseek/deepseek-pro-latest
Impact: 20
Quick Win: 8
Complexity: 5
Confidence: 75
Actionability: 40
keep open Adds tests/spread to osv-exclude-paths in policy.yaml to stop OSV scanning spread fixtures. Approved but CI still failing on PR title, lint/files, and OSV-scanner.
~deepseek/deepseek-pro-latest
Impact: 25
Quick Win: 10
Complexity: 5
Confidence: 70
Actionability: 40
needs review Adds tests/spread to osv-exclude-paths in policy.yaml to stop OSV scanning spread test fixtures. One-line CI config change; CI still failing on PR title convention and OSV-scanner.

Update history

Date Change
closed
updated
updated
updated
created

Related issues

Issue Project State Summary Similarity
#2951 ci: exclude tests from OSV source scan charmcraft merged Merged PR #2951 (commit 5dc3fd6c) excluded test directories from OSV source scanning, removing test requirements and lock files; paired with merged dependency update #2950.
79%
#1738 ci: exclude tests/integration from the OSV source scan craft-parts closed Closed unmerged after the OSV exclusion was included via #1728; tests/integration is now excluded alongside docs in policy.yaml.
74%
#1498 ci(osv-scanner): ignore integration tests craft-parts merged Merged #1498 (commit 559a7daf), excluding tests/integration from OSV-Scanner inputs to prevent false-positive dependency findings.
72%
#3480 ci: spread testing snapcraft closed Closed unmerged: cjp256's experimental CI spread-testing PR, described as 'Just a test, ignore me for now', drew no reviews, comments or CI checks and was abandoned. No commit references #3480.
72%
#157 ci(scan): allow ignoring files/directories starflow merged Merged #157, adding configurable OSV-scanner exclusions so docs dependencies are ignored. All CI passed; docs fixes are deferred to the Sphinx Stack and Starbase update pipeline.
71%
#505 ci(osv-scanner): ignore integration tests starbase merged Merged as commit e7954a7: OSV-scanner config now excludes integration tests, silencing false positives from test-only dependencies. Downstream change landed in canonical/craft-parts#1498.
70%