fix: scan uv.lock natively with osv-scanner
Metadata
Current evaluation
Closed without merging. The native uv.lock scanning fix was abandoned due to widespread CI test failures across multiple Python environments.
Suggested action: —
No scores available.
Issue body
Fixes https://github.com/canonical/starflow/issues/28
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Closed without merging. The native uv.lock scanning fix was abandoned due to widespread CI test failures across multiple Python environments. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged to resolve issue #28 by enabling native scanning of uv.lock files with osv-scanner. The change updates the dependency scanning workflow to directly parse uv.lock, replacing previous workarounds. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #28 Use osv-scanner to scan `uv.lock` files | starflow | open | Enhancement to add osv-scanner scanning of uv.lock files in the scan-python workflow. Blocked by google/osv-scanner#1406 which is now resolved; implementation pending osv-scanner version update via iosifache/osv-scanner-snap#3. | |
| #27 feat(scan-python): more configurable uv | starflow | merged | Merged after maintainer approval and commit signing. Disables uv.lock exporting and adds a Trivy scan using a uv-synced virtual environment, resolving export limitations and improving security coverage. |