Use osv-scanner to scan `uv.lock` files
Metadata
Current evaluation
Enhancement: make the scan-python reusable workflow scan uv.lock directly with osv-scanner. Blocker google/osv-scanner#1406 reported resolved in a May 2025 comment, but it is still unimplemented — the workflow deletes uv.lock whenever uv-export is enabled.
Suggested action: keep open
Reason: The issue carries 'Type: Enhancement' / 'Status: Triaged' and a contributor comment ('The blocking issue has now been resolved, so we can implement that but the osv-scanner must be updated') explicitly unblocking it. Reading .github/workflows/scan-python.yaml confirms the gap remains: the 'Remove files from source scan' step still prepends uv.lock to files_to_remove when UV_EXPORT is true, and the only install is `sudo snap install osv-scanner` with no version/channel pinning, so the requested behaviour is not implemented anywhere in history. It should stay open as a valid, maintainer-acknowledged enhancement; confidence is limited because the remaining unknown (whether the published snap now handles uv.lock, or whether the iosifache/osv-scanner-snap fork is required) cannot be verified from this repo alone.
Evaluated by: mr-cal-bot
Issue body
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
45
Quick Win:
17
Complexity:
45
Confidence:
76
Actionability:
68
|
keep open | Enhancement: make the scan-python reusable workflow scan uv.lock directly with osv-scanner. Blocker google/osv-scanner#1406 reported resolved in a May 2025 comment, but it is still unimplemented — the workflow deletes uv.lock whenever uv-export is enabled. | |
| qwen/qwen3.6-35b-a3b |
Impact:
40
Quick Win:
22
Complexity:
20
Confidence:
75
Actionability:
70
|
keep open | Enhancement to add uv.lock scanning to scan-python workflow using osv-scanner. Was blocked by google/osv-scanner#1406, which is now resolved. | |
| qwen/qwen3.8-27b |
Impact:
50
Quick Win:
35
Staleness:
45
Complexity:
30
Confidence:
70
Support Request:
0
|
keep open | Enhancement to add osv-scanner scanning of uv.lock files in the scan-python workflow. Blocked by google/osv-scanner#1406 which is now resolved; implementation pending osv-scanner version update via iosifache/osv-scanner-snap#3. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
65
Complexity:
20
Confidence:
90
Support Request:
0
|
keep open | Enhancement to add uv.lock scanning to the scan-python workflow using osv-scanner. Triaged and unblocked after upstream resolution, awaiting implementation. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
75
Complexity:
30
Confidence:
75
Support Request:
5
|
keep open | Enhancement to scan uv.lock files in the scan-python workflow using osv-scanner. The external blocker is resolved, but implementation has been pending for over a year. |
Update history
No update history recorded yet.
Related work
-
Related To:
osv-scanner#1406
(confidence 95%)
Cited in the issue body as the original blocker; @upils states it 'has now been resolved', so it no longer blocks but explains the delay.
-
Related To:
osv-scanner-snap#3
(confidence 85%)
Referenced in @upils' comment as the change needed to make the osv-scanner snap understand uv.lock; no equivalent change exists in starflow's history.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #153 fix: scan uv.lock natively with osv-scanner | starflow | closed | PR #153 was closed unmerged after widespread Python test failures; native uv.lock scanning was not delivered, and issue #28 remains open. |