← Back to issue list

ci(osv-scanner): ignore integration tests

View original Github issue

Metadata

Project
starbase
Number
#505
Type
pull request
State
merged
Author
mr-cal
Labels
—
Created
Updated
Closed

Current evaluation

Merged as commit e7954a7: OSV-scanner config now excludes integration tests, silencing false positives from test-only dependencies. Downstream change landed in canonical/craft-parts#1498.

Resolution: closed resolved

Reason: PR #505 was approved by 2 reviewers with all CI checks passing and merged into main as commit e7954a7 ("ci(osv-scanner): ignore integration tests"), adding an ignore rule to osv-scanner.toml. It was then upstreamed to canonical/craft-parts#1498 (merged as 559a7daf).

Evaluated by: mr-cal-bot

No scores available.

Issue body

Avoids false positives for dependencies in integration tests. Upstream of https://github.com/canonical/craft-parts/pull/1498 --- - [x] I've followed the [contribution guidelines](https://github.com/canonical/starbase/blob/main/CONTRIBUTING.md). - [x] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [x] I've successfully run `make lint && make test`. - [x] I've added or updated any relevant documentation. - [x] I've updated the relevant release notes.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged as commit e7954a7: OSV-scanner config now excludes integration tests, silencing false positives from test-only dependencies. Downstream change landed in canonical/craft-parts#1498.
stealth/space-bunny-alpha — closed resolved Merged #1498, excluding integration-test dependencies from OSV-scanner to prevent false positives; the change was also upstreamed to canonical/starbase.
stealth/space-bunny-alpha — closed resolved Merged in canonical/craft-parts#1498, excluding integration tests from OSV-scanner to prevent false-positive dependency alerts; the two-line change was upstreamed to canonical/starbase.
qwen/qwen3.6-35b-a3b — — Merged CI configuration changes to configure osv-scanner to ignore integration tests, preventing false positive dependency warnings. Approved by two reviewers with all checks passing.
qwen3.6-35b-a3b-mtp-q6 — — Merged CI configuration updates to configure osv-scanner to ignore integration tests, eliminating false positive dependency alerts. Acts as the upstream fix for craft-parts pull request 1498.

Update history

No update history recorded yet.

Related work

  • Related To: canonical/craft-parts#1498 (confidence 98%)

    Downstream copy of this change in craft-parts, merged as 559a7daf; PR body cites it as the upstream of the change.

Related issues

Issue Project State Summary Similarity
#1498 ci(osv-scanner): ignore integration tests craft-parts merged Merged #1498 (commit 559a7daf), excluding tests/integration from OSV-Scanner inputs to prevent false-positive dependency findings.
92%
#371 chore: ignore osv-scanner false positives imagecraft closed Superseded by canonical/imagecraft#505, merged as e7954a7 to add OSV-Scanner exclusions for integration-test false positives; #371's conflicts were resolved in 2beb57d.
76%
#1738 ci: exclude tests/integration from the OSV source scan craft-parts closed Closed unmerged after the OSV exclusion was included via #1728; tests/integration is now excluded alongside docs in policy.yaml.
76%
#2951 ci: exclude tests from OSV source scan charmcraft merged Merged PR #2951 (commit 5dc3fd6c) excluded test directories from OSV source scanning, removing test requirements and lock files; paired with merged dependency update #2950.
75%
#5487 ci: remove config for osv scanner snapcraft merged Merged PR #5487 as commit 866694712, removing four lines of resolved, expired OSV scanner configuration from CI.
72%
#988 ci: fix OSV scanner policy workflow craft-providers merged Merged as e6a3482: updated OSV scanner inputs and config, excluded docs paths/groups, and added osv-scanner.toml. All CI checks passed.
71%
#2913 ci: exclude Spread tests from OSV dependency scans charmcraft closed PR #2913 to exclude tests/spread from OSV scans was closed without merging; CI checks (lint, conventional commits, OSV-scanner) were still failing at closure.
70%