🤖 This message was generated by kimi-k3. ## Problem The `python-scans` job in `.github/workflows/policy.yaml` lost its `permissions` block and its entire `with:` configuration, so the OSV-scanner runs with `OSV_EXCLUDE_PATHS` empty. It then scans `docs/requirements.txt`, and because the docs groups are also absent from `uv-export-no-groups`, resolves the unpinned specifiers (e.g. `sphinx-autobuild`) at their **minimum** satisfying versions — flagging vulnerabilities in `anyio 4.9.0`, `h11 0.9.0`, and `idna 3.9.0`, none of which are ever actually installed (the uv.lock already contains fixed versions of all three). This currently fails the `Security scan / OSV-scanner` check on unrelated PRs (e.g. #505, #506). ## Fix Restore the missing `permissions` and `with:` blocks, excluding `docs` from the OSV scan and the docs dependency groups from the `uv export` — matching how [snapcraft](https://github.com/canonical/snapcraft/blob/main/.github/workflows/policy.yaml) and [charmcraft](https://github.com/canonical/charmcraft/blob/main/.github/workflows/policy.yaml) configure the same reusable `canonical/starflow/scan-python.yaml` workflow. The docs requirements are development-only tooling, not shipped artifacts. ## Validation - Snapcraft's most recent "Security scan" run with this configuration passes and its log shows `OSV_EXCLUDE_PATHS: docs` taking effect (`--experimental-exclude docs`). - craft-cli CI logs from #505/#506 show the same job with `OSV_EXCLUDE_PATHS:` empty — this PR restores exactly that input. ## Provenance Discovered while validating preparation PRs for the Starbase sync (#507), where the starbase-provided `policy.yaml` includes this configuration by default. The exact exclusion set (`docs` only, no `tests/spread`) matches this repository's structure — craft-cli has no spread tests.