[dangertoaster]

🤖 This message was generated by kimi-k3.

Problem

The python-scans job in .github/workflows/policy.yaml lost its permissions block and its entire with: configuration, so the OSV-scanner runs with OSV_EXCLUDE_PATHS empty. It then scans docs/requirements.txt, and because the docs groups are also absent from uv-export-no-groups, resolves the unpinned specifiers (e.g. sphinx-autobuild) at their minimum satisfying versions — flagging vulnerabilities in anyio 4.9.0, h11 0.9.0, and idna 3.9.0, none of which are ever actually installed (the uv.lock already contains fixed versions of all three).

This currently fails the Security scan / OSV-scanner check on unrelated PRs (e.g. #505, #506).

Fix

Restore the missing permissions and with: blocks, excluding docs from the OSV scan and the docs dependency groups from the uv export — matching how snapcraft and charmcraft configure the same reusable canonical/starflow/scan-python.yaml workflow. The docs requirements are development-only tooling, not shipped artifacts.

Validation

• Snapcraft's most recent "Security scan" run with this configuration passes and its log shows OSV_EXCLUDE_PATHS: docs taking effect (--experimental-exclude docs).
• craft-cli CI logs from test: make completion test robust to shfmt formatting #505/style: format pyproject.toml with tombi #506 show the same job with OSV_EXCLUDE_PATHS: empty — this PR restores exactly that input.

Provenance

Discovered while validating preparation PRs for the Starbase sync (#507), where the starbase-provided policy.yaml includes this configuration by default. The exact exclusion set (docs only, no tests/spread) matches this repository's structure — craft-cli has no spread tests.

[dangertoaster]

🤖 [BEEP BOOP, A BOT WROTE THIS COMMENT - kimi-k3, opencode]

Closing as unnecessary — the starbase merge PR (#507) already restores the complete python-scans configuration in policy.yaml (including the with: block) and adds the osv-scanner.toml config file, so the OSV-scanner failures only affect PRs branched from plain main until the merge lands. No separate fix needed.