CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-09 14:38:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): OSV suppression config actually loads — explicit global --config + expiring, reasoned ignores

Browse Source 
The ignore file was inert from v1.65.0.0: OSV-Scanner only auto-discovers
configs named osv-scanner.toml (no leading dot) and applies them
per-directory, so the root config never covered lib/diagram-render/bun.lock
either way. The workflow now passes --config=.osv-scanner.toml globally.
Every IgnoredVulns entry carries a reason with an upgrade trigger and an
ignoreUntil expiry (~90 days) so suppressions must be re-justified. A wiring
test pins flag ↔ filename ↔ entry hygiene so the file can never silently go
inert again.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-08-31 20:49:05 +00:00
co-authored by Claude Fable 5
parent 6258257cfc
commit 716196bba5
3 changed files with 89 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/osv-scanner.yml
+1
View File
@@ -21,6 +21,7 @@ jobs:
uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@f4cfcc01edc9c8b756a9b873b7a623ca674da51e # v2.3.8
with:
scan-args: |-
--config=.osv-scanner.toml
--include-git-root
--recursive
./