fix: scan uv.lock natively with osv-scanner
Metadata
Current evaluation
PR #153 was closed unmerged after widespread Python test failures; native uv.lock scanning was not delivered, and issue #28 remains open.
Resolution: closed stale
Reason: No resolving PR or commit landed: #153 was closed unmerged with numerous failing Python test jobs, pending review, and no follow-up comments. Issue canonical/starflow#28 remains open.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Fixes https://github.com/canonical/starflow/issues/28
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | PR #153 was closed unmerged after widespread Python test failures; native uv.lock scanning was not delivered, and issue #28 remains open. | |
| stealth/space-bunny-alpha | — | closed stale | PR #153 was closed unmerged after widespread Python CI failures; native uv.lock scanning was not delivered, and issue #28 remains open. | |
| stealth/space-bunny-alpha | — | closed stale | Closed unmerged after widespread Python test failures; #28 remained open, so native uv.lock scanning was not delivered. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without merging. The native uv.lock scanning fix was abandoned due to widespread CI test failures across multiple Python environments. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged to resolve issue #28 by enabling native scanning of uv.lock files with osv-scanner. The change updates the dependency scanning workflow to directly parse uv.lock, replacing previous workarounds. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/starflow#28
(confidence 99%)
PR #153 stated that it fixed #28, but that enhancement remains open and unimplemented.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #28 Use osv-scanner to scan `uv.lock` files | starflow | open | Enhancement: make the scan-python reusable workflow scan uv.lock directly with osv-scanner. Blocker google/osv-scanner#1406 reported resolved in a May 2025 comment, but it is still unimplemented — the workflow deletes uv.lock whenever uv-export is enabled. |