ci: adopt the shared osv-scan lane (infra#104) - #3
Merged
Conversation
Byte-identical copy of ci-workflows templates/deps.yml, pinned to osv-scan.yml@162accb, verified with `diff`. Adopted at HARD-FAIL (ci-workflows#15 flipped the template default). WHAT GREEN MEANS HERE: this repo has deno.json but NO deno.lock, so the lane passes via --allow-no-lockfiles. That is "nothing to scan", not "scanned and clean". Worth being especially clear about in this repo, because it is the same ecosystem as fold-engine, where a deno.lock DID exist and turned up nine advisories including a CVSS 8.7. The difference in outcome is entirely about whether a lockfile is committed, not about whether the code has dependencies. Committing a deno.lock here would convert this check from a formality into real coverage — worth considering separately from this PR. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LF9Cu8u4dkCEM8MXC1QeDL
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Byte-identical copy of
templates/deps.ymlpinned toosv-scan.yml@162accb, verified withdiff. Adopted at hard-fail (ci-workflows#15).What green means here
This repo has
deno.jsonbut nodeno.lock, so the lane passes via--allow-no-lockfiles. That's "nothing to scan", not "scanned and clean".Worth being especially clear about here, because this is the same ecosystem as fold-engine — where a
deno.lockdoes exist and turned up nine advisories including a CVSS 8.7.The difference in outcome is entirely about whether a lockfile is committed, not about whether the code has dependencies. Committing a
deno.lockhere would convert this check from a formality into real coverage — worth considering separately from this PR.Generated by Claude Code