fix(ci): remove invalid osv-scanner flags#519
Merged
Conversation
The osv-scan job failed on first-run with "Incorrect Usage: flag provided but not defined: -skip-git". Both --skip-git and --severity were incorrect guesses — osv-scanner v2.3.5 does not accept them. Strip to minimal known-good flags: --recursive --format=sarif --output=... ./. The scanner now gates on ANY vulnerability via its default exit code. SARIF upload still publishes to Code Scanning for tracking. If the scan is too noisy post-merge, severity filtering can be applied via GitHub's Security tab or by post-processing the SARIF. Refs: first-run failure at https://github.com/Detair/kaiku/actions/runs/24292956710
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
The first-run osv-scan (after flag fix) found 34 vulnerabilities — most are already accepted via deny.toml / rust-audit ignores or via PR #517 (vite dev-server exceptions nested through vitest). osv-scanner is stricter than cargo-audit: it flags "unmaintained" crates as errors where cargo-audit treats them as warnings. Create .osv-scanner.toml at repo root with an explicit ignore list: - 3 entries already in deny.toml (rsa Marvin, rand 0.8.5, lru) - 11 entries for the gtk-rs 0.18 family (Linux-only Tauri deps, blocked on Tauri's gtk-rs pin) - 11 entries for unmaintained-crate advisories (proc-macro-error, paste, instant, derivative, fxhash, unic-*, bincode) - 3 entries for the vite CVEs already documented in PR #517 as accepted dev-only exceptions Also pass --config to scan-args so the scanner picks up the file. Local verification: osv-scanner --config=.osv-scanner.toml --recursive ./ now reports "No issues found" with 36 filtered vulnerabilities. When NEW advisories appear, osv-scanner will fail the build and we investigate, then either fix the dep or add a new entry here. Refs: first-run findings at https://github.com/Detair/kaiku/actions/runs/24293038310
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes two issues with the osv-scanner CI job added in #518:
Invalid flags —
--skip-gitand--severity=HIGHwere both non-existent. First-run failed withflag provided but not defined: -skip-git.Noisy findings — after removing the invalid flags, osv-scanner found 34 advisories (mostly unmaintained-crate warnings that cargo-audit treats as warnings, not errors, plus the 3 vite CVEs already documented in PR chore(client): clear 11 devtime advisories via transitive overrides #517 as accepted dev-only exceptions).
Fix
3cf6e3e: Strip to minimal valid flags (--recursive --format=sarif --output ./).adec7e0: Add.osv-scanner.tomlignore config with 28 entries (accepted deny.toml advisories + gtk-rs 0.18 family unmaintained warnings + vite PR chore(client): clear 11 devtime advisories via transitive overrides #517 exceptions). Pass--config=/github/workspace/.osv-scanner.tomlto the scanner.Ignore list structure (28 entries)
Each entry has a
reasonfield with justification.Verification
Local run:
CI run on branch (https://github.com/Detair/kaiku/actions/runs/24293183995):
Refs
🤖 Generated with Claude Code