ci: ignore sample files in OSV scans
Metadata
Current evaluation
Merged PR #962 as commit e9b702cb to exclude documentation and spread-test sample files from OSV scans, avoiding findings for demo-only vulnerable versions.
Resolution: closed resolved
Reason: PR #962 was approved and merged with all CI checks passing. Commit e9b702cb added the requested OSV scan exclusions, with no unresolved review comments.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This ignores files from documentation and spread tests in our OSV scans. They're probably okay to have vulnerable versions since they're for demo purposes only.
- [x] Have you followed the guidelines for contributing?
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [x] Have you successfully run `make lint && make test`?
---
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #962 as commit e9b702cb to exclude documentation and spread-test sample files from OSV scans, avoiding findings for demo-only vulnerable versions. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR canonical/rockcraft#962 (commit e9b702cb) excludes documentation and spread-test samples from OSV scans, suppressing alerts for intentionally demo-only vulnerable versions. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #962 (commit e9b702cb) excludes documentation and spread-test sample files from OSV scans, preventing demo-only vulnerable versions from being flagged. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #962, excluding documentation and spread-test sample files with demo-only vulnerable versions from OSV scans. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR canonical/rockcraft#962 excluded documentation and spread-test samples from OSV scans, avoiding alerts for intentionally demo-only vulnerable versions. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged CI configuration changes to ignore documentation and spread test sample files in OSV scans. Approved by two reviewers with all checks passing, preventing security alerts for demo-only content. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged CI updates to exclude documentation and spread test sample files from OSV vulnerability scans. These demo files are expected to contain outdated dependencies, so excluding them prevents false positives and streamlines security scanning. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1130 ci: fix OSV-scanner workflow path and exclude docs-only inputs | craft-application | merged | Merged PR #1130 as commit 235a5cc0, correcting the OSV config path and excluding docs paths and docs-only dependency groups from security scans. | |
| #1299 ci: fix osv scanner on docs | rockcraft | merged | Merged PR #1299 via commit c0191bb5, configuring OSV Scanner to ignore documentation-derived content and fix docs security scanning. | |
| #2951 ci: exclude tests from OSV source scan | charmcraft | merged | Merged PR #2951 (commit 5dc3fd6c) excluded test directories from OSV source scanning, removing test requirements and lock files; paired with merged dependency update #2950. | |
| #5487 ci: remove config for osv scanner | snapcraft | merged | Merged PR #5487 as commit 866694712, removing four lines of resolved, expired OSV scanner configuration from CI. | |
| #157 ci(scan): allow ignoring files/directories | starflow | merged | Merged #157, adding configurable OSV-scanner exclusions so docs dependencies are ignored. All CI passed; docs fixes are deferred to the Sphinx Stack and Starbase update pipeline. | |
| #1498 ci(osv-scanner): ignore integration tests | craft-parts | merged | Merged #1498 (commit 559a7daf), excluding tests/integration from OSV-Scanner inputs to prevent false-positive dependency findings. |