ci: exclude docs from security scan
Metadata
Current evaluation
Merged as commit 03ce591: adds `osv-exclude-paths: "docs/"` to .github/workflows/security-scan.yaml so the starflow OSV-scanner job stops failing on docs/requirements.txt (idna via canonical-sphinx).
Resolution: closed resolved
Reason: PR #654 was approved with all CI checks green and merged to main as commit 03ce591 ("ci: exclude docs from security scan (#654)"); the workflow file at HEAD now contains `osv-exclude-paths: "docs/"`.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
-----
The OSV scanner job in `canonical/starflow/.github/workflows/scan-golang.yaml` recursively scans the repository. Without explicit directory exclusions, it scans `docs/requirements.txt` and fails due to transitive dependencies resolved by deps.dev for Sphinx plugins (e.g. `idna` under `canonical-sphinx`).
This updates `.github/workflows/security-scan.yaml` to pass `osv-exclude-paths: "docs/"`, matching the standard configuration recommended by starflow.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged as commit 03ce591: adds `osv-exclude-paths: "docs/"` to .github/workflows/security-scan.yaml so the starflow OSV-scanner job stops failing on docs/requirements.txt (idna via canonical-sphinx). | |
| stealth/space-bunny-alpha | — | closed resolved | Merged CI tweak: adds `osv-exclude-paths: "docs/"` to canonical/starflow .github/workflows/security-scan.yaml so the OSV-scanner job stops failing on docs/requirements.txt (idna via canonical-sphinx). +2/-0, approved, all CI green. | |
| stealth/space-bunny-alpha |
Impact:
18
Quick Win:
17
Complexity:
5
Confidence:
97
Actionability:
98
|
needs review | Excludes docs/ from the OSV Go security scan to avoid failures from transitive Python dependencies in docs/requirements.txt. Approved with all CI checks passing. | |
| stealth/space-bunny-alpha |
Impact:
30
Quick Win:
21
Complexity:
10
Confidence:
94
Actionability:
78
|
needs review | Excludes docs/ from OSV scanning to prevent Sphinx documentation dependencies from failing the Go job; OSV passes, with two snap-test jobs pending. |
Update history
| Date | Change |
|---|---|
| closed | |
| updated | |
| created |
Related work
-
Related To:
canonical/fetch-service#233
(confidence 82%)
Commit 3dadebe added the security scanner job that this PR configures by excluding docs/ from the scan.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1130 ci: fix OSV-scanner workflow path and exclude docs-only inputs | craft-application | merged | Merged PR #1130 as commit 235a5cc0, correcting the OSV config path and excluding docs paths and docs-only dependency groups from security scans. | |
| #157 ci(scan): allow ignoring files/directories | starflow | merged | Merged #157, adding configurable OSV-scanner exclusions so docs dependencies are ignored. All CI passed; docs fixes are deferred to the Sphinx Stack and Starbase update pipeline. | |
| #1299 ci: fix osv scanner on docs | rockcraft | merged | Merged PR #1299 via commit c0191bb5, configuring OSV Scanner to ignore documentation-derived content and fix docs security scanning. | |
| #6347 ci(scan): fix osv scanner on docs | snapcraft | merged | Merged in snapcraft#6347 as 5bb3aff7d, porting starbase#573 to add OSV exclusions so documentation inputs no longer fail security scanning. | |
| #508 ci: restore osv-scanner configuration in policy workflow | craft-cli | closed | Merged PR #508 to restore OSV-scanner configuration in `.github/workflows/policy.yaml`, excluding `docs` from scans to prevent false positive vulnerability reports. | |
| #988 ci: fix OSV scanner policy workflow | craft-providers | merged | Merged as e6a3482: updated OSV scanner inputs and config, excluded docs paths/groups, and added osv-scanner.toml. All CI checks passed. | |
| #1640 ci: align policy OSV scanner inputs | craft-parts | merged | PR #1640 merged as commit 159bad0d, aligning .github/workflows/policy.yaml OSV inputs with starbase #573: added osv-extra-args/exclude-paths, uv-export-no-groups, removed requirements-find-args, added root osv-scanner.toml. |