ci(osv-scanner): ignore integration tests
Metadata
Current evaluation
Merged #1498 (commit 559a7daf), excluding tests/integration from OSV-Scanner inputs to prevent false-positive dependency findings.
Resolution: closed resolved
Reason: The pull request was merged as commit 559a7daf, adding the scanner exclusion to the policy workflow. The change was upstreamed through canonical/starbase#505.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [x] Have you followed the guidelines for contributing?
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [x] Have you successfully run `make lint && make test`?
- [x] Have you added an entry to the changelog (`docs/reference/changelog.rst`)?
---
To avoid false positives for dependencies in integration tests. This already happened once in #1471.
Upstreamed in https://github.com/canonical/starbase/pull/505
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged #1498 (commit 559a7daf), excluding tests/integration from OSV-Scanner inputs to prevent false-positive dependency findings. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged as 559a7daf: OSV-scanner now excludes integration tests to prevent false-positive alerts from test-only dependencies. Upstreamed in canonical/starbase#505. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged craft-parts#1498 (commit 559a7daf), excluding integration-test dependencies from OSV-scanner to prevent false positives; upstreamed as canonical/starbase#505. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged to configure OSV-scanner to ignore integration tests, preventing false positive dependency alerts. Approved by two reviewers and upstreamed to canonical/starbase. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged to configure osv-scanner to ignore integration tests, preventing dependency false positives. The change was also upstreamed to canonical/starbase#505. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/starbase#505
(confidence 100%)
Identified in the merged pull request as the upstream counterpart.
-
Related To:
canonical/craft-parts#1471
(confidence 98%)
A prior OSV-related dependency upgrade whose false positive motivated this exclusion.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #505 ci(osv-scanner): ignore integration tests | starbase | merged | Merged as commit e7954a7: OSV-scanner config now excludes integration tests, silencing false positives from test-only dependencies. Downstream change landed in canonical/craft-parts#1498. | |
| #1738 ci: exclude tests/integration from the OSV source scan | craft-parts | closed | Closed unmerged after the OSV exclusion was included via #1728; tests/integration is now excluded alongside docs in policy.yaml. | |
| #2951 ci: exclude tests from OSV source scan | charmcraft | merged | Merged PR #2951 (commit 5dc3fd6c) excluded test directories from OSV source scanning, removing test requirements and lock files; paired with merged dependency update #2950. | |
| #371 chore: ignore osv-scanner false positives | imagecraft | closed | Superseded by canonical/imagecraft#505, merged as e7954a7 to add OSV-Scanner exclusions for integration-test false positives; #371's conflicts were resolved in 2beb57d. | |
| #5487 ci: remove config for osv scanner | snapcraft | merged | Merged PR #5487 as commit 866694712, removing four lines of resolved, expired OSV scanner configuration from CI. | |
| #2913 ci: exclude Spread tests from OSV dependency scans | charmcraft | closed | PR #2913 to exclude tests/spread from OSV scans was closed without merging; CI checks (lint, conventional commits, OSV-scanner) were still failing at closure. | |
| #157 ci(scan): allow ignoring files/directories | starflow | merged | Merged #157, adding configurable OSV-scanner exclusions so docs dependencies are ignored. All CI passed; docs fixes are deferred to the Sphinx Stack and Starbase update pipeline. | |
| #1130 ci: fix OSV-scanner workflow path and exclude docs-only inputs | craft-application | merged | Merged PR #1130 as commit 235a5cc0, correcting the OSV config path and excluding docs paths and docs-only dependency groups from security scans. | |
| #962 ci: ignore sample files in OSV scans | rockcraft | merged | Merged PR #962 as commit e9b702cb to exclude documentation and spread-test sample files from OSV scans, avoiding findings for demo-only vulnerable versions. | |
| #988 ci: fix OSV scanner policy workflow | craft-providers | merged | Merged as e6a3482: updated OSV scanner inputs and config, excluded docs paths/groups, and added osv-scanner.toml. All CI checks passed. |