feat: remove trivy scanning
Metadata
Current evaluation
Merged PR #159 removed Trivy scanning and kept OSV-Scanner; commit d88e247 also dropped unused uv-sync-extra-args and retained trivy-extra-args as a no-op.
Resolution: closed resolved
Reason: PR canonical/starflow#159 was merged as commit d88e247, removing the Trivy scan while retaining OSV-Scanner. It also preserved trivy-extra-args compatibility as a no-op for Snapcraft.
Evaluated by: mr-cal-bot
No scores available.
Issue body
The security scan workflow has become burdensome for us, and part of that is the complexity of the scan invocations making it difficult to know where problems came from.
SSDLC requirements only mandate that we use one of [Trivy, OSV-Scanner], so using both was unnecessary complexity.
OSV-Scanner is simpler to invoke today, and team discussion seems to agree that it's the one to keep.
Note: `uv-sync-extra-args` was removed wholesale as a search found that nobody was using that argument today. `trivy-extra-args` is being used today by Snapcraft though, and so I kept it as a no-op.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #159 removed Trivy scanning and kept OSV-Scanner; commit d88e247 also dropped unused uv-sync-extra-args and retained trivy-extra-args as a no-op. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR canonical/starflow#159 removed Trivy scanning and retained OSV-Scanner. It also removed unused uv-sync-extra-args while keeping trivy-extra-args as a Snapcraft-compatible no-op. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged removal of Trivy scanning to reduce complexity. OSV-Scanner is retained as the sole SSDLC-mandated tool. Unused uv-sync-extra-args was dropped, while trivy-extra-args remains a no-op for Snapcraft. Approved by two reviewers and passed CI. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
5
Complexity:
15
Confidence:
85
|
needs review | Removes the Trivy security scanning workflow to reduce complexity, as OSV-Scanner already satisfies SSDLC requirements. Drops unused uv-sync-extra-args and retains trivy-extra-args as a no-op. Currently unreviewed and fresh. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #5487 ci: remove config for osv scanner | snapcraft | merged | Merged PR #5487 as commit 866694712, removing four lines of resolved, expired OSV scanner configuration from CI. |