ci: fix OSV scanner policy workflow
Metadata
Current evaluation
Merged as e6a3482: updated OSV scanner inputs and config, excluded docs paths/groups, and added osv-scanner.toml. All CI checks passed.
Resolution: closed resolved
Reason: PR #988 was merged as commit e6a3482, fixing the OSV policy workflow; the PR reports all security and test checks passing.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Sloperated by GPT-5.3-Codex
## Summary
- switch to current scan-python OSV inputs
- pass OSV config via osv-extra-args
- exclude docs path and docs dependency groups from UV export for scanning
- add osv-scanner.toml
## Context
Aligns with the approach used in canonical/starbase#573 and addresses the OSV scan failures seen in run 29360705241.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged as e6a3482: updated OSV scanner inputs and config, excluded docs paths/groups, and added osv-scanner.toml. All CI checks passed. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged as e6a3482, fixing the OSV policy workflow with current scan inputs, osv-extra-args configuration, docs exclusions, and osv-scanner.toml. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #988 as e6a3482, updating OSV Scanner inputs and configuration, excluding docs from UV export, adding osv-scanner.toml, and restoring passing security scans. | |
| stealth/space-bunny-alpha | — | closed resolved | PR #988 merged into main (commit e6a3482): fixed the OSV scanner policy workflow by switching to current scan-python inputs, passing OSV config via osv-extra-args, excluding docs paths/groups from UV export, and adding osv-scanner.toml. All CI checks passed. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #988 as e6a3482, updating OSV scanner inputs, passing config via osv-extra-args, excluding docs from UV export, and adding osv-scanner.toml. All CI checks passed. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged fix for OSV scanner policy workflow failures. Updated scan-python inputs, passed configuration via osv-extra-args, excluded docs from UV export, and added osv-scanner.toml. All CI checks passed. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged fix for OSV scanner policy workflow failures. Updated scan-python inputs, passed config via osv-extra-args, excluded docs paths and dependencies from UV export, and added osv-scanner.toml. Aligns with canonical/starbase#573. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/starbase#573
(confidence 90%)
PR #988 explicitly modeled its scanner configuration approach on this related change.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1130 ci: fix OSV-scanner workflow path and exclude docs-only inputs | craft-application | merged | Merged PR #1130 as commit 235a5cc0, correcting the OSV config path and excluding docs paths and docs-only dependency groups from security scans. | |
| #253 ci: align policy OSV scanner inputs with starbase | craft-platforms | merged | Merged PR (canonical/craft-platforms#253) aligned policy.yaml OSV scanner inputs with starbase: added osv-extra-args/--config=osv-scanner.toml, osv-exclude-paths, uv-export-no-groups, dropped requirements-find-args, added root osv-scanner.toml. All CI checks passed. | |
| #1640 ci: align policy OSV scanner inputs | craft-parts | merged | PR #1640 merged as commit 159bad0d, aligning .github/workflows/policy.yaml OSV inputs with starbase #573: added osv-extra-args/exclude-paths, uv-export-no-groups, removed requirements-find-args, added root osv-scanner.toml. | |
| #200 ci: align policy OSV scan inputs with starbase | craft-grammar | merged | Merged PR #200 as commit c359e99, adding osv-scanner.toml and aligning policy OSV inputs with starbase by excluding docs and skipping docs UV groups. | |
| #1639 ci: align policy OSV scanner inputs | craft-parts | closed | PR #1639 (align policy OSV scanner inputs) was closed unmerged as superseded by #1640, which merged as commit 159bad0d applying the same OSV workflow inputs and root osv-scanner.toml config. | |
| #1299 ci: fix osv scanner on docs | rockcraft | merged | Merged PR #1299 via commit c0191bb5, configuring OSV Scanner to ignore documentation-derived content and fix docs security scanning. | |
| #508 ci: restore osv-scanner configuration in policy workflow | craft-cli | closed | Merged PR #508 to restore OSV-scanner configuration in `.github/workflows/policy.yaml`, excluding `docs` from scans to prevent false positive vulnerability reports. | |
| #6347 ci(scan): fix osv scanner on docs | snapcraft | merged | Merged in snapcraft#6347 as 5bb3aff7d, porting starbase#573 to add OSV exclusions so documentation inputs no longer fail security scanning. | |
| #5487 ci: remove config for osv scanner | snapcraft | merged | Merged PR #5487 as commit 866694712, removing four lines of resolved, expired OSV scanner configuration from CI. | |
| #927 ci: clean up OSV workflows | rockcraft | closed | Merged PR #927 as commit 2daac417, standardizing OSV scanner arguments with Snapcraft and Charmcraft and removing outdated configuration. |