ci: align policy scan inputs with starbase
Metadata
Current evaluation
Closed unmerged: the PR added .github/workflows/policy.yaml plus osv-scanner.toml to align scan-python inputs with canonical/starbase#573. lengau closed it 2026-07-14 as unnecessary.
Resolution: closed not a bug
Reason: Maintainer lengau closed the PR unmerged with the comment "Closing as unnecessary — this repository does not use the policy/scan-python workflow pattern targeted by the starbase #573 fix." The change was an AI-slopped port of canonical/starbase#573 (merged as commit c4133af), which applies to starbase's own policy.yaml, not craft-actions.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Sloperated by gpt-5
## Summary
- add `.github/workflows/policy.yaml` with the policy and python security scan jobs
- update scan-python inputs to use `osv-extra-args`, `osv-exclude-paths`, and `uv-export-no-groups`
- ensure `requirements-find-args` is not present in the scan `with:` block
- add `osv-scanner.toml` with the OSV scanner config placeholder
## Dependency/lockfile changes
- none required: this change only updates GitHub workflow inputs and adds a scanner config file; no dependency manifests or lockfiles were changed.
## Validation
- `npx --yes prettier --check .github/workflows/policy.yaml`
- verified `osv-scanner.toml` content matches expected single-line placeholder
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed not a bug | Closed unmerged: the PR added .github/workflows/policy.yaml plus osv-scanner.toml to align scan-python inputs with canonical/starbase#573. lengau closed it 2026-07-14 as unnecessary. | |
| stealth/space-bunny-alpha | — | closed stale | Closed unmerged as unnecessary: craft-actions does not use the policy/scan-python workflow targeted by the starbase #573 fix. | |
| stealth/space-bunny-alpha | — | closed not a bug | Closed unmerged as unnecessary: craft-actions does not use the policy/scan-python workflow targeted by starbase#573, so the proposed policy.yaml and OSV scanner changes were redundant. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without merging as unnecessary. The repository does not use the policy/scan-python workflow pattern targeted by the starbase #573 fix, rendering the alignment changes redundant. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
5
Complexity:
15
Confidence:
85
|
needs review | Updates GitHub Actions policy scan workflow inputs to align with starbase, adds osv-scanner.toml placeholder, and removes deprecated arguments. Currently awaiting review. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/starbase#573
(confidence 92%)
Source of the slopped change; merged into starbase main (c4133af), bumping the python-scans job inputs and adding osv-scanner.toml — a change irrelevant to craft-actions.
-
Duplicate Of:
canonical/starbase#573
(confidence 55%)
Same 2-file (+7/-1) CI scanner-input change applied to a repo that does not consume that workflow; effectively redundant with the upstream fix.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #81 ci: align policy scan inputs with starbase PR 573 | craft-actions | closed | PR #81 (add policy.yaml + osv-scanner.toml, align scan-python inputs with starbase#573) was closed unmerged by maintainer lengau, superseded by #82 which used the required work/fix-osv head branch. | |
| #1640 ci: align policy OSV scanner inputs | craft-parts | merged | PR #1640 merged as commit 159bad0d, aligning .github/workflows/policy.yaml OSV inputs with starbase #573: added osv-extra-args/exclude-paths, uv-export-no-groups, removed requirements-find-args, added root osv-scanner.toml. | |
| #200 ci: align policy OSV scan inputs with starbase | craft-grammar | merged | Merged PR #200 as commit c359e99, adding osv-scanner.toml and aligning policy OSV inputs with starbase by excluding docs and skipping docs UV groups. | |
| #252 ci: align policy OSV scanner inputs with starbase | craft-platforms | closed | Closed as superseded by #253, which merged the same OSV workflow-input and scanner-config alignment in commit 2ac71ad. | |
| #199 ci: align policy OSV scan inputs with starbase | craft-grammar | closed | Closed unmerged as superseded; canonical/craft-grammar#200 merged the same OSV workflow and scanner-config changes in commit c359e99. | |
| #253 ci: align policy OSV scanner inputs with starbase | craft-platforms | merged | Merged PR (canonical/craft-platforms#253) aligned policy.yaml OSV scanner inputs with starbase: added osv-extra-args/--config=osv-scanner.toml, osv-exclude-paths, uv-export-no-groups, dropped requirements-find-args, added root osv-scanner.toml. All CI checks passed. | |
| #1639 ci: align policy OSV scanner inputs | craft-parts | closed | PR #1639 (align policy OSV scanner inputs) was closed unmerged as superseded by #1640, which merged as commit 159bad0d applying the same OSV workflow inputs and root osv-scanner.toml config. | |
| #861 ci: use starflow policy checker | craft-parts | closed | Closed unmerged; Starflow policy-scanner work later landed in PR #573 via commit c4133af4. | |
| #573 ci: update usage of starflow security scanner | starbase | merged | PR #573 by lengau merged into main (commit c4133af) with 2 approvals and all CI green. Bumped the python-scans job in policy.yaml to newest starflow security-scanner options, adding an osv-scanner.toml placeholder and exclude paths (+7/-1, 2 files). | |
| #12 feat: policy check workflows | starflow | closed | Closed unmerged; the reusable policy-check work was superseded by merged canonical/starflow#18, adding test, lint, and policy-check workflows in commit cd64717. |