fix(ci): centralize OSV vulnerability ignores in org-wide config#143
fix(ci): centralize OSV vulnerability ignores in org-wide config#143JacobPEvans merged 2 commits intomainfrom
Conversation
Add osv-scanner.toml at repo root with org-wide vulnerability ignores for CVEs with no upstream fix (pygments, nltk, requests). Update _osv-scan.yml to fetch this central config when repos don't have a local osv-scanner.toml — local configs take precedence for overrides. This eliminates the need for per-directory osv-scanner.toml files in individual repos (closes JacobPEvans/nix-ai#344 approach). (claude)
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request streamlines vulnerability management by centralizing OSV scanner ignore rules. By moving these configurations to an organization-wide file, it reduces duplication across repositories while ensuring that local overrides remain respected for specific project needs. Highlights
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. A scanner runs to find the flaw, To keep the code within the law. With central rules to guide the way, We keep the vulnerabilities at bay. Footnotes
|
There was a problem hiding this comment.
Pull request overview
Centralizes OSV scanner vulnerability ignore configuration in the org-wide .github repo and updates the reusable OSV scan workflow to automatically use that central config when a caller repo doesn’t provide its own override.
Changes:
- Add an org-wide
osv-scanner.tomlwith vulnerability ignore entries. - Update reusable workflow
_osv-scan.ymlto fetch the central config only when a localosv-scanner.tomlis absent. - Apply a “local config wins” precedence by preferring an in-repo
osv-scanner.tomlover the fetched central one.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
osv-scanner.toml |
Introduces the shared ignore list intended to be inherited by org repos. |
.github/workflows/_osv-scan.yml |
Fetches and applies the central osv-scanner.toml when no local override exists. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Update comment to acknowledge that some ignores are for CVEs with available fixes that are pending Renovate upgrade rollout. (claude)
PR #143: Centralize OSV Vulnerability Ignores
Summary
osv-scanner.tomlwith org-wide vulnerability ignores for CVEs with no upstream fix_osv-scan.ymlto fetch central config when repos don't have a local overrideosv-scanner.tomlin a repo takes precedence over central configChanges
Replaces JacobPEvans/nix-ai#344 — centralizes ignores in
.githubinstead of per-repo duplication.Test plan
_osv-scan.ymlfetches central config in repos without localosv-scanner.tomlosv-scanner.tomlstill use their own config