ci(scan): allow ignoring files/directories
Metadata
Current evaluation
Merged #157, adding configurable OSV-scanner exclusions so docs dependencies are ignored. All CI passed; docs fixes are deferred to the Sphinx Stack and Starbase update pipeline.
Resolution: closed resolved
Reason: canonical/starflow#157 was merged with three approvals and all CI checks passing, adding configurable OSV-scanner file and directory exclusions.
Evaluated by: mr-cal-bot
No scores available.
Issue body
From the docs sync discussion, this change will make the OSV scanner ignore all docs issues moving forward.
The intended path for fixes now will be:
- All docs dependencies come from Sphinx Stack
- Sphinx Stack will patch these through its own OSV alerts
- Starbase will adopt new versions of Sphinx Stack
- Repositories will update Starbase, which gets them these patches.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged #157, adding configurable OSV-scanner exclusions so docs dependencies are ignored. All CI passed; docs fixes are deferred to the Sphinx Stack and Starbase update pipeline. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged with 3 approvals and all CI checks passing, adding configurable OSV-scanner file/directory exclusions. Docs dependency fixes are deferred to the Sphinx Stack and Starbase update pipeline. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged after approval and passing CI. Enables the OSV scanner to ignore specified files and directories, deferring documentation dependency fixes to the Sphinx Stack and Starbase update pipeline. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
15
Complexity:
25
Confidence:
90
|
keep open | Draft PR adding CI configuration to allow OSV scanner to ignore specific files and directories. Currently blocked on simplifying the workflow via PR #159 before finalizing fixes. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
5
Complexity:
15
Confidence:
90
|
needs review | Modifies CI configuration to exclude the docs/ directory from Python dependency scanning. Aligns dependency management with Sphinx Stack and Starbase workflows. Currently awaiting review. |
Update history
No update history recorded yet.
Related work
-
Related To:
starflow#159
(confidence 70%)
The author linked #159 as related workflow simplification work before finalizing #157.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #6347 ci(scan): fix osv scanner on docs | snapcraft | merged | Merged in snapcraft#6347 as 5bb3aff7d, porting starbase#573 to add OSV exclusions so documentation inputs no longer fail security scanning. | |
| #654 ci: exclude docs from security scan | fetch-service | closed | Merged as commit 03ce591: adds `osv-exclude-paths: "docs/"` to .github/workflows/security-scan.yaml so the starflow OSV-scanner job stops failing on docs/requirements.txt (idna via canonical-sphinx). | |
| #1130 ci: fix OSV-scanner workflow path and exclude docs-only inputs | craft-application | merged | Merged PR #1130 as commit 235a5cc0, correcting the OSV config path and excluding docs paths and docs-only dependency groups from security scans. | |
| #988 ci: fix OSV scanner policy workflow | craft-providers | merged | Merged as e6a3482: updated OSV scanner inputs and config, excluded docs paths/groups, and added osv-scanner.toml. All CI checks passed. | |
| #2951 ci: exclude tests from OSV source scan | charmcraft | merged | Merged PR #2951 (commit 5dc3fd6c) excluded test directories from OSV source scanning, removing test requirements and lock files; paired with merged dependency update #2950. | |
| #1498 ci(osv-scanner): ignore integration tests | craft-parts | merged | Merged #1498 (commit 559a7daf), excluding tests/integration from OSV-Scanner inputs to prevent false-positive dependency findings. | |
| #962 ci: ignore sample files in OSV scans | rockcraft | merged | Merged PR #962 as commit e9b702cb to exclude documentation and spread-test sample files from OSV scans, avoiding findings for demo-only vulnerable versions. | |
| #1299 ci: fix osv scanner on docs | rockcraft | merged | Merged PR #1299 via commit c0191bb5, configuring OSV Scanner to ignore documentation-derived content and fix docs security scanning. | |
| #2913 ci: exclude Spread tests from OSV dependency scans | charmcraft | closed | PR #2913 to exclude tests/spread from OSV scans was closed without merging; CI checks (lint, conventional commits, OSV-scanner) were still failing at closure. | |
| #253 ci: align policy OSV scanner inputs with starbase | craft-platforms | merged | Merged PR (canonical/craft-platforms#253) aligned policy.yaml OSV scanner inputs with starbase: added osv-extra-args/--config=osv-scanner.toml, osv-exclude-paths, uv-export-no-groups, dropped requirements-find-args, added root osv-scanner.toml. All CI checks passed. |