ci: exclude tests/integration from the OSV source scan
Metadata
Current evaluation
Closed unmerged after the OSV exclusion was included via #1728; tests/integration is now excluded alongside docs in policy.yaml.
Resolution: closed superseded
Reason: The change was superseded by the merged starbase synchronization in #1728 (commit d2be519e). The resulting policy workflow excludes tests/integration from OSV scans alongside docs.
Evaluated by: mr-cal-bot
No scores available.
Issue body
The integration-test fixtures under `tests/integration` contain their own lockfiles and manifests (`pom.xml`, requirements files, `go.mod`, …) for packages that are never published or shipped. These cause two problems for the OSV source scan:
- osv-scanner's transitive resolution fails outright on fixtures like the unpublished `org.starcraft:*` Maven modules (exit 127, no scan results).
- Version pins intentionally kept for testing create vulnerability-finding noise.
This excludes `tests/integration` from the source scan via `osv-exclude-paths`, alongside the existing `docs` exclusion. Verified locally with osv-scanner 2.3.8 (the version installed in CI) that no extraction errors remain with this exclusion.
Surfaced while working on canonical/craft-parts#1728; split out as a preparation PR since it stands on its own merits.
🤖 [BEEP BOOP, A BOT WROTE THIS PR - Kimi K3, Copilot CLI]
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Closed unmerged after the OSV exclusion was included via #1728; tests/integration is now excluded alongside docs in policy.yaml. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #1498 in commit 559a7daf, excluding tests/integration fixtures from OSV source scans while retaining the existing docs exclusion. | |
| stealth/space-bunny-alpha |
Impact:
18
Quick Win:
2
Complexity:
8
Confidence:
91
Actionability:
15
|
close superseded | Adds tests/integration to the OSV scanner exclusion, but the identical change already merged in #1498; this PR has no reviewers and its OSV-scanner check is failing. | |
| qwen/qwen3.6-35b-a3b |
Impact:
20
Quick Win:
0
Complexity:
5
Confidence:
90
Actionability:
0
|
close superseded | Excludes tests/integration from OSV source scan in CI workflow. Change is already present in repo HEAD via craft-parts#1498. |
Update history
| Date | Change |
|---|---|
| closed | |
| updated | |
| updated | |
| updated | |
| updated | |
| created |
Related work
-
Superseded By:
canonical/craft-parts#1728
(confidence 93%)
The merged starbase sync delivered the equivalent OSV path exclusion, and the current policy workflow contains it.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #2951 ci: exclude tests from OSV source scan | charmcraft | merged | Merged PR #2951 (commit 5dc3fd6c) excluded test directories from OSV source scanning, removing test requirements and lock files; paired with merged dependency update #2950. | |
| #1498 ci(osv-scanner): ignore integration tests | craft-parts | merged | Merged #1498 (commit 559a7daf), excluding tests/integration from OSV-Scanner inputs to prevent false-positive dependency findings. | |
| #505 ci(osv-scanner): ignore integration tests | starbase | merged | Merged as commit e7954a7: OSV-scanner config now excludes integration tests, silencing false positives from test-only dependencies. Downstream change landed in canonical/craft-parts#1498. | |
| #2913 ci: exclude Spread tests from OSV dependency scans | charmcraft | closed | PR #2913 to exclude tests/spread from OSV scans was closed without merging; CI checks (lint, conventional commits, OSV-scanner) were still failing at closure. | |
| #988 ci: fix OSV scanner policy workflow | craft-providers | merged | Merged as e6a3482: updated OSV scanner inputs and config, excluded docs paths/groups, and added osv-scanner.toml. All CI checks passed. | |
| #1640 ci: align policy OSV scanner inputs | craft-parts | merged | PR #1640 merged as commit 159bad0d, aligning .github/workflows/policy.yaml OSV inputs with starbase #573: added osv-extra-args/exclude-paths, uv-export-no-groups, removed requirements-find-args, added root osv-scanner.toml. | |
| #253 ci: align policy OSV scanner inputs with starbase | craft-platforms | merged | Merged PR (canonical/craft-platforms#253) aligned policy.yaml OSV scanner inputs with starbase: added osv-extra-args/--config=osv-scanner.toml, osv-exclude-paths, uv-export-no-groups, dropped requirements-find-args, added root osv-scanner.toml. All CI checks passed. | |
| #1639 ci: align policy OSV scanner inputs | craft-parts | closed | PR #1639 (align policy OSV scanner inputs) was closed unmerged as superseded by #1640, which merged as commit 159bad0d applying the same OSV workflow inputs and root osv-scanner.toml config. |