ci: fix OSV-scanner workflow path and exclude docs-only inputs
Metadata
Current evaluation
Merged. Corrected the OSV-scanner workflow config path to align with Starbase and excluded docs from scanning. Updated the uv lockfile for httplib2 and setuptools to resolve scanner failures. All CI checks passed.
Suggested action: —
No scores available.
Issue body
The `Security scan / OSV-scanner` job was failing because the workflow passed a config path that no longer existed from the scanner's working directory. This change aligns `craft-application` with the Starbase scanner wiring, then scopes the scan away from docs-only dependency inputs that are not part of the shipped application surface.
- **Root cause**
- `scan-python.yaml` runs OSV inside `source/`, but this repository passed `--config=source/.osv-scanner.toml`.
- That resolved to a non-existent path at runtime, causing the scanner to fail before evaluating dependencies.
- **Starbase parity**
- Move the scanner config from `.osv-scanner.toml` to `osv-scanner.toml`.
- Update the workflow to pass `--config=osv-scanner.toml`, matching the current Starbase integration pattern.
- **Repository-specific OSV scope**
- Exclude `docs/` from the recursive source scan.
- Exclude the `docs` and `docs-starter-pack` dependency groups from exported requirements scanning.
- Keep the existing ignored vulnerability entry in the relocated config file.
- **Resulting workflow shape**
```yaml
with:
uv-export-extra-args: "--extra remote"
osv-extra-args: "--config=osv-scanner.toml"
osv-exclude-paths: |
docs
uv-export-no-groups: |
docs
docs-starter-pack
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged. Corrected the OSV-scanner workflow config path to align with Starbase and excluded docs from scanning. Updated the uv lockfile for httplib2 and setuptools to resolve scanner failures. All CI checks passed. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
10
Confidence:
90
|
needs review | Fixes failing OSV-scanner CI by correcting config path and excluding docs dependencies. Approved by two reviewers, CI mostly passing, ready for maintainer review and merge. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
0
Complexity:
15
Confidence:
90
|
needs review | Fixes failing OSV-scanner CI workflow by correcting config path and excluding docs. Incorporates maintainer-requested lockfile updates. Ready for maintainer review. |
Update history
| Date | Change |
|---|---|
| updated |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #988 ci: fix OSV scanner policy workflow | craft-providers | merged | Merged fix for OSV scanner policy workflow failures. Updated scan-python inputs, passed configuration via osv-extra-args, excluded docs from UV export, and added osv-scanner.toml. All CI checks passed. | |
| #200 ci: align policy OSV scan inputs with starbase | craft-grammar | merged | Merged. Updated CI workflow to align OSV security scan inputs with starbase, added a root config file, and excluded docs from scans. All CI checks passed. | |
| #235 ci: update OSV scanner to match starbase | craft-archives | merged | Merged changes to update the OSV scanner configuration, aligning it with the starbase repository. Approved by one reviewer, passed all CI checks, and modified four files to replicate upstream updates. | |
| #1299 ci: fix osv scanner on docs | rockcraft | merged | Merged a configuration update to make the OSV scanner ignore documentation files. Approved by a reviewer, passed CI checks, and resolved scanner false positives in the docs directory with a single file change. | |
| #1640 ci: align policy OSV scanner inputs | craft-parts | merged | Merged. Aligns CI OSV scanner workflow inputs with starbase PR #573 by adding osv-scanner.toml, configuring extra args and excluded paths, and removing legacy requirements-find-args. No dependency updates required. | |
| #253 ci: align policy OSV scanner inputs with starbase | craft-platforms | merged | Merged after passing all CI checks and approval. Updated the CI workflow to align OSV scanner inputs with starbase, configured osv-scanner.toml, and removed redundant arguments to standardize dependency scanning. | |
| #6347 ci(scan): fix osv scanner on docs | snapcraft | merged | Merged after approval. The change updates the CI pipeline to fix the OSV security scanner for documentation builds, resolving the scanning configuration issue. | |
| #5487 ci: remove config for osv scanner | snapcraft | merged | Merged after approval by two reviewers. Removed expired OSV scanner configuration from CI. Updated one file with a four-line reduction. All required CI checks passed prior to merge. | |
| #160 fix(scan): fix path resolution for osv-scanner file arguments | starflow | merged | Merged fix for osv-scanner path resolution. Removes the required source/ prefix in osv-extra-args, enabling direct config file references. Approved by one reviewer and passed CI checks prior to merge. | |
| #252 ci: align policy OSV scanner inputs with starbase | craft-platforms | closed | Superseded to align with branch naming requirements. The PR updated CI workflow and OSV scanner configuration to match starbase standards but was closed and reopened as a draft from the work/fix-osv branch. |