From 8915ce4ec2ed28b97c398868eea4a2f315b911ea Mon Sep 17 00:00:00 2001 From: dangertoaster Date: Fri, 16 Oct 2026 17:12:54 +0000 Subject: [PATCH] ci: restore osv-scanner configuration in policy workflow The python-scans job lost its permissions block and its entire 'with' configuration (osv-exclude-paths, uv-export-no-groups), so OSV-scanner runs without the docs exclusions. The scanner then resolves the unpinned specifiers in docs/requirements.txt at their minimum versions and reports vulnerabilities (anyio, h11, idna) in versions that are never actually installed. Restore the docs exclusions, matching how snapcraft and charmcraft configure the same reusable workflow. --- .github/workflows/policy.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/policy.yaml b/.github/workflows/policy.yaml index 3b1383d4..33c90a41 100644 --- a/.github/workflows/policy.yaml +++ b/.github/workflows/policy.yaml @@ -16,4 +16,13 @@ jobs: uses: canonical/starflow/.github/workflows/policy.yaml@main python-scans: name: Security scan + permissions: + contents: read uses: canonical/starflow/.github/workflows/scan-python.yaml@main + with: + osv-extra-args: "--config=osv-scanner.toml" + osv-exclude-paths: | + docs + uv-export-no-groups: | + docs + docs-sphinx-stack