feat(scan-python): more configurable uv
Metadata
Current evaluation
Merged after maintainer approval and commit signing. Disables uv.lock exporting and adds a Trivy scan using a uv-synced virtual environment, resolving export limitations and improving security coverage.
Suggested action: —
No scores available.
Issue body
This allows disabling of uv.lock exporting (needed because uv cannot always export to requirements.txt) and adds a trivy scan using a uv sync created virtual environment.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged after maintainer approval and commit signing. Disables uv.lock exporting and adds a Trivy scan using a uv-synced virtual environment, resolving export limitations and improving security coverage. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged by maintainer lengau. Adds configuration to disable uv.lock exporting and integrates trivy scanning with a uv-synced virtual environment. Force-pushed to sign commits prior to merge. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #26 feat(scan-python): allow extra uv export arguments | starflow | merged | Merged. Enables passing extra arguments to uv export, resolving venv scan failures caused by charmcraft's apt extra. Approved by two reviewers and merged with an 8-line addition. | |
| #29 fix(scan-python): Fix uv sync extra args input | starflow | merged | Merged a one-line fix for the scan-python component that corrected the uv sync extra arguments input. Approved by a reviewer and integrated without additional comments or CI checks. | |
| #153 fix: scan uv.lock natively with osv-scanner | starflow | closed | Closed without merging. The native uv.lock scanning fix was abandoned due to widespread CI test failures across multiple Python environments. |