The `Security scan / OSV-scanner` job was failing because the workflow passed a config path that no longer existed from the scanner's working directory. This change aligns `craft-application` with the Starbase scanner wiring, then scopes the scan away from docs-only dependency inputs that are not part of the shipped application surface. - **Root cause** - `scan-python.yaml` runs OSV inside `source/`, but this repository passed `--config=source/.osv-scanner.toml`. - That resolved to a non-existent path at runtime, causing the scanner to fail before evaluating dependencies. - **Starbase parity** - Move the scanner config from `.osv-scanner.toml` to `osv-scanner.toml`. - Update the workflow to pass `--config=osv-scanner.toml`, matching the current Starbase integration pattern. - **Repository-specific OSV scope** - Exclude `docs/` from the recursive source scan. - Exclude the `docs` and `docs-starter-pack` dependency groups from exported requirements scanning. - Keep the existing ignored vulnerability entry in the relocated config file. - **Resulting workflow shape** ```yaml with: uv-export-extra-args: "--extra remote" osv-extra-args: "--config=osv-scanner.toml" osv-exclude-paths: | docs uv-export-no-groups: | docs docs-starter-pack ```