← Back to issue list

feat: new secscan action

View original Github issue

Metadata

Project
starflow
Number
#155
Type
pull request
State
open
Author
bepri
Labels
—
Created
Updated
Closed
—

Current evaluation

Adds a reusable secscan action to run OSV/CVE scans on new tags or monthly against latest/stable. All CI checks green, but 17 review threads are unresolved and the cited snapcraft#6303 trial was closed unmerged after scan jobs failed.

Suggested action: needs review

Reason: CI is fully green, but the PR sits at 'pending (0 reviewers)' with 17 unresolved review comments and no activity for 101 days, and the author's own trial PR canonical/snapcraft#6303 is recorded as closed unmerged after secscan/OSV-scanner/integration jobs failed — so the action is unvalidated and needs maintainer (author-side) re-engagement rather than a blind merge. The +104,278/-2 line diff across 13 files is far too large to validate without the authors addressing the outstanding feedback. Not closing as stale: a maintainer authored it, an upstream ticket exists, and the blocked item is a real external failure, not abandonment.

Evaluated by: mr-cal-bot

Impact: 40 Quick Win: 4 Complexity: 68 Confidence: 62 Actionability: 35

Issue body

Creates a new action to automate secscan. The intended use-case is for this to run on new tags, or as a monthly workflow against `latest/stable`. You can see it in action here: https://github.com/canonical/snapcraft/pull/6303 CRAFT-5208

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha
Impact: 40
Quick Win: 4
Complexity: 68
Confidence: 62
Actionability: 35
needs review Adds a reusable secscan action to run OSV/CVE scans on new tags or monthly against latest/stable. All CI checks green, but 17 review threads are unresolved and the cited snapcraft#6303 trial was closed unmerged after scan jobs failed.
stealth/space-bunny-alpha
Impact: 55
Quick Win: 12
Complexity: 55
Confidence: 85
Actionability: 50
needs review Adds a reusable secscan action for tag-based or monthly latest/stable scans. PR CI is green, but 17 review threads remain unresolved and the cited Snapcraft trial reports failures.
qwen3.6-35b-a3b-mtp-q6
Impact: 60
Quick Win: 27
Staleness: 75
Complexity: 55
Confidence: 45
close stale Adds a new secscan action for automated security scanning on tags or monthly workflows. Inactive for 73 days with 17 unresolved review comments and no reviewer engagement.
qwen/qwen3.6-35b-a3b
Staleness: 45
Complexity: 45
Confidence: 90
needs review Introduces a new security scanning action for automated execution on new tags or monthly workflows. Currently pending review with 17 unresolved comments and all CI checks passing.
qwen3.6-35b-a3b-mtp-q6
Staleness: 15
Complexity: 25
Confidence: 85
needs review Introduces a new GitHub Action for automated security scanning, intended for tag pushes and monthly runs. Currently awaiting maintainer review with no comments or approvals.

Update history

No update history recorded yet.

Related work

  • Blocked By: canonical/snapcraft#6303 (confidence 72%)

    The cited end-to-end trial ('ci: test new secscan action') is closed unmerged after secscan, OSV-scanner, and integration jobs failed, indicating this action still has functional defects.

  • Related To: canonical/starbase#272 (confidence 45%)

    Merged downstream adoption of Starflow CI actions; suggests other consumers wait on actions in this repo landing successfully.

Related issues

Issue Project State Summary Similarity
#6303 ci: test new secscan action snapcraft closed PR #6303 tested a new secscan CI action but was closed unmerged after secscan, OSV-scanner, and multiple integration jobs failed.
77%