ci: fix osv scanner on docs
Metadata
Current evaluation
Merged PR #1299 via commit c0191bb5, configuring OSV Scanner to ignore documentation-derived content and fix docs security scanning.
Resolution: closed resolved
Reason: PR #1299 was approved and merged into main as commit c0191bb5, adding the OSV Scanner exclusion for content originating from the documentation.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This should make OSV scanner ignore anything that comes from the docs now.
---
- [ ] I've followed the [contribution guidelines](https://github.com/canonical/rockcraft/blob/main/CONTRIBUTING.md).
- [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [ ] I've successfully run `make lint && make test`.
- [ ] I've added or updated any relevant documentation.
- [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing.
- [ ] I've updated the relevant release notes.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #1299 via commit c0191bb5, configuring OSV Scanner to ignore documentation-derived content and fix docs security scanning. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #1299 via commit c0191bb5, fixing OSV scanning by excluding documentation-derived content. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged a configuration update to make the OSV scanner ignore documentation files. Approved by a reviewer, passed CI checks, and resolved scanner false positives in the docs directory with a single file change. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged CI configuration changes that exclude documentation files from OSV scanning, resolving false positive security alerts in the docs directory. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1130 ci: fix OSV-scanner workflow path and exclude docs-only inputs | craft-application | merged | Merged PR #1130 as commit 235a5cc0, correcting the OSV config path and excluding docs paths and docs-only dependency groups from security scans. | |
| #6347 ci(scan): fix osv scanner on docs | snapcraft | merged | Merged in snapcraft#6347 as 5bb3aff7d, porting starbase#573 to add OSV exclusions so documentation inputs no longer fail security scanning. | |
| #988 ci: fix OSV scanner policy workflow | craft-providers | merged | Merged as e6a3482: updated OSV scanner inputs and config, excluded docs paths/groups, and added osv-scanner.toml. All CI checks passed. | |
| #5487 ci: remove config for osv scanner | snapcraft | merged | Merged PR #5487 as commit 866694712, removing four lines of resolved, expired OSV scanner configuration from CI. | |
| #962 ci: ignore sample files in OSV scans | rockcraft | merged | Merged PR #962 as commit e9b702cb to exclude documentation and spread-test sample files from OSV scans, avoiding findings for demo-only vulnerable versions. | |
| #508 ci: restore osv-scanner configuration in policy workflow | craft-cli | closed | Merged PR #508 to restore OSV-scanner configuration in `.github/workflows/policy.yaml`, excluding `docs` from scans to prevent false positive vulnerability reports. | |
| #654 ci: exclude docs from security scan | fetch-service | closed | Merged as commit 03ce591: adds `osv-exclude-paths: "docs/"` to .github/workflows/security-scan.yaml so the starflow OSV-scanner job stops failing on docs/requirements.txt (idna via canonical-sphinx). | |
| #2821 ci: fix osv workflow errors | charmcraft | merged | Merged as commit 67922e47; repaired the OSV security workflow and updated cryptography to resolve the reported OSV finding. | |
| #157 ci(scan): allow ignoring files/directories | starflow | merged | Merged #157, adding configurable OSV-scanner exclusions so docs dependencies are ignored. All CI passed; docs fixes are deferred to the Sphinx Stack and Starbase update pipeline. | |
| #2951 ci: exclude tests from OSV source scan | charmcraft | merged | Merged PR #2951 (commit 5dc3fd6c) excluded test directories from OSV source scanning, removing test requirements and lock files; paired with merged dependency update #2950. |