ci: align policy OSV scanner inputs
Metadata
Current evaluation
PR #1640 merged as commit 159bad0d, aligning .github/workflows/policy.yaml OSV inputs with starbase #573: added osv-extra-args/exclude-paths, uv-export-no-groups, removed requirements-find-args, added root osv-scanner.toml.
Resolution: closed resolved
Reason: The PR was merged into main as commit 159bad0d ("ci: align policy OSV scanner inputs (#1640)"), which added osv-scanner.toml and updated the policy workflow's OSV scanner inputs; the Security scan / OSV-scanner and lint / files CI checks passed.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Sloperated by gpt-5.6-terra
## Summary
- align `.github/workflows/policy.yaml` security scan inputs with starbase PR #573
- add `osv-extra-args: "--config=osv-scanner.toml"`
- add `osv-exclude-paths` for `docs`
- add `uv-export-no-groups` for `docs` and `docs-sphinx-stack`
- remove `requirements-find-args`
- add root `osv-scanner.toml`
## Dependency/lockfile impact
No dependency or lockfile updates were required. This change only adjusts OSV scan workflow inputs and adds scanner configuration.
## Validation
- targeted checks to confirm required workflow keys are present and `requirements-find-args` is absent
- verified `osv-scanner.toml` exists with expected content
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | PR #1640 merged as commit 159bad0d, aligning .github/workflows/policy.yaml OSV inputs with starbase #573: added osv-extra-args/exclude-paths, uv-export-no-groups, removed requirements-find-args, added root osv-scanner.toml. | |
| stealth/space-bunny-alpha | — | closed superseded | PR #1639’s OSV policy alignment was superseded by merged PR #1640, which updated scanner inputs, added osv-scanner.toml and removed legacy requirements-find-args. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged. Aligns CI OSV scanner workflow inputs with starbase PR #573 by adding osv-scanner.toml, configuring extra args and excluded paths, and removing legacy requirements-find-args. No dependency updates required. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
5
Complexity:
15
Confidence:
90
|
needs review | Updates CI policy workflow to align OSV scanner inputs with starbase PR #573. Adds osv-scanner.toml, configures exclude paths and export args, removes legacy requirements-find-args. Currently awaiting review. |
Update history
| Date | Change |
|---|---|
| updated |
Related work
-
Superseded By:
canonical/craft-parts#1639
(confidence 80%)
Earlier OSV policy alignment PR that was superseded by the merged #1640.
-
Related To:
canonical/craft-parts#1498
(confidence 55%)
Earlier commit 559a7daf added OSV-scanner ignore config; #1640 formalises it via osv-scanner.toml.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #253 ci: align policy OSV scanner inputs with starbase | craft-platforms | merged | Merged PR (canonical/craft-platforms#253) aligned policy.yaml OSV scanner inputs with starbase: added osv-extra-args/--config=osv-scanner.toml, osv-exclude-paths, uv-export-no-groups, dropped requirements-find-args, added root osv-scanner.toml. All CI checks passed. | |
| #200 ci: align policy OSV scan inputs with starbase | craft-grammar | merged | Merged PR #200 as commit c359e99, adding osv-scanner.toml and aligning policy OSV inputs with starbase by excluding docs and skipping docs UV groups. | |
| #1639 ci: align policy OSV scanner inputs | craft-parts | closed | PR #1639 (align policy OSV scanner inputs) was closed unmerged as superseded by #1640, which merged as commit 159bad0d applying the same OSV workflow inputs and root osv-scanner.toml config. | |
| #252 ci: align policy OSV scanner inputs with starbase | craft-platforms | closed | Closed as superseded by #253, which merged the same OSV workflow-input and scanner-config alignment in commit 2ac71ad. | |
| #82 ci: align policy scan inputs with starbase | craft-actions | closed | Closed unmerged: the PR added .github/workflows/policy.yaml plus osv-scanner.toml to align scan-python inputs with canonical/starbase#573. lengau closed it 2026-07-14 as unnecessary. | |
| #81 ci: align policy scan inputs with starbase PR 573 | craft-actions | closed | PR #81 (add policy.yaml + osv-scanner.toml, align scan-python inputs with starbase#573) was closed unmerged by maintainer lengau, superseded by #82 which used the required work/fix-osv head branch. | |
| #199 ci: align policy OSV scan inputs with starbase | craft-grammar | closed | Closed unmerged as superseded; canonical/craft-grammar#200 merged the same OSV workflow and scanner-config changes in commit c359e99. | |
| #988 ci: fix OSV scanner policy workflow | craft-providers | merged | Merged as e6a3482: updated OSV scanner inputs and config, excluded docs paths/groups, and added osv-scanner.toml. All CI checks passed. | |
| #1130 ci: fix OSV-scanner workflow path and exclude docs-only inputs | craft-application | merged | Merged PR #1130 as commit 235a5cc0, correcting the OSV config path and excluding docs paths and docs-only dependency groups from security scans. | |
| #508 ci: restore osv-scanner configuration in policy workflow | craft-cli | closed | Merged PR #508 to restore OSV-scanner configuration in `.github/workflows/policy.yaml`, excluding `docs` from scans to prevent false positive vulnerability reports. |