ci: align policy OSV scanner inputs
Metadata
Current evaluation
Merged. Aligns CI OSV scanner workflow inputs with starbase PR #573 by adding osv-scanner.toml, configuring extra args and excluded paths, and removing legacy requirements-find-args. No dependency updates required.
Suggested action: —
No scores available.
Issue body
Sloperated by gpt-5.6-terra
## Summary
- align `.github/workflows/policy.yaml` security scan inputs with starbase PR #573
- add `osv-extra-args: "--config=osv-scanner.toml"`
- add `osv-exclude-paths` for `docs`
- add `uv-export-no-groups` for `docs` and `docs-sphinx-stack`
- remove `requirements-find-args`
- add root `osv-scanner.toml`
## Dependency/lockfile impact
No dependency or lockfile updates were required. This change only adjusts OSV scan workflow inputs and adds scanner configuration.
## Validation
- targeted checks to confirm required workflow keys are present and `requirements-find-args` is absent
- verified `osv-scanner.toml` exists with expected content
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged. Aligns CI OSV scanner workflow inputs with starbase PR #573 by adding osv-scanner.toml, configuring extra args and excluded paths, and removing legacy requirements-find-args. No dependency updates required. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
5
Complexity:
15
Confidence:
90
|
needs review | Updates CI policy workflow to align OSV scanner inputs with starbase PR #573. Adds osv-scanner.toml, configures exclude paths and export args, removes legacy requirements-find-args. Currently awaiting review. |
Update history
| Date | Change |
|---|---|
| updated |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #253 ci: align policy OSV scanner inputs with starbase | craft-platforms | merged | Merged after passing all CI checks and approval. Updated the CI workflow to align OSV scanner inputs with starbase, configured osv-scanner.toml, and removed redundant arguments to standardize dependency scanning. | |
| #200 ci: align policy OSV scan inputs with starbase | craft-grammar | merged | Merged. Updated CI workflow to align OSV security scan inputs with starbase, added a root config file, and excluded docs from scans. All CI checks passed. | |
| #252 ci: align policy OSV scanner inputs with starbase | craft-platforms | closed | Superseded to align with branch naming requirements. The PR updated CI workflow and OSV scanner configuration to match starbase standards but was closed and reopened as a draft from the work/fix-osv branch. | |
| #199 ci: align policy OSV scan inputs with starbase | craft-grammar | closed | Superseded to align with required head branch work/fix-osv. The PR updated CI OSV scan inputs and added a placeholder config but was closed without merging. | |
| #1639 ci: align policy OSV scanner inputs | craft-parts | closed | Superseded by pull request #1640. Adjusts OSV scanner workflow inputs, adds configuration files, and excludes specific paths to align security scanning policies. | |
| #81 ci: align policy scan inputs with starbase PR 573 | craft-actions | closed | Superseded by PR #82, which applies the required head branch work/fix-osv. The original policy scan input alignments and OSV scanner configuration were replaced rather than merged. | |
| #988 ci: fix OSV scanner policy workflow | craft-providers | merged | Merged fix for OSV scanner policy workflow failures. Updated scan-python inputs, passed configuration via osv-extra-args, excluded docs from UV export, and added osv-scanner.toml. All CI checks passed. | |
| #1130 ci: fix OSV-scanner workflow path and exclude docs-only inputs | craft-application | merged | Merged. Corrected the OSV-scanner workflow config path to align with Starbase and excluded docs from scanning. Updated the uv lockfile for httplib2 and setuptools to resolve scanner failures. All CI checks passed. | |
| #235 ci: update OSV scanner to match starbase | craft-archives | merged | Merged changes to update the OSV scanner configuration, aligning it with the starbase repository. Approved by one reviewer, passed all CI checks, and modified four files to replicate upstream updates. | |
| #5487 ci: remove config for osv scanner | snapcraft | merged | Merged after approval by two reviewers. Removed expired OSV scanner configuration from CI. Updated one file with a four-line reduction. All required CI checks passed prior to merge. |