Skip to content

🐛 Avoid OSV scans when no target is available#5077

Open
bmendonca3 wants to merge 1 commit into
ossf:mainfrom
bmendonca3:fix-osv-empty-scan-target
Open

🐛 Avoid OSV scans when no target is available#5077
bmendonca3 wants to merge 1 commit into
ossf:mainfrom
bmendonca3:fix-osv-empty-scan-target

Conversation

@bmendonca3

Copy link
Copy Markdown

Summary

  • avoid invoking osv-scanner when Scorecard has neither a commit nor a local path to scan
  • carry the missing-target state through the Vulnerabilities check as NotApplicable/Inconclusive instead of scoring it as zero vulnerabilities
  • add regression coverage for the OSV client, raw data propagation, probe outcome, evaluation, and top-level check

Fixes #5056

Testing

  • go test ./clients ./checks/raw ./probes/hasOSVVulnerabilities ./checks/evaluation ./checks ./pkg/scorecard

Signed-off-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
@bmendonca3 bmendonca3 requested a review from a team as a code owner May 29, 2026 02:22
@bmendonca3 bmendonca3 requested review from jeffmendoza and justaugustus and removed request for a team May 29, 2026 02:22
@dosubot dosubot Bot added the size:S This PR changes 10-29 lines, ignoring generated files. label May 29, 2026

@justaugustus justaugustus left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See note about AI contributions —> ossf/allstar#841 (comment)

@github-actions

github-actions Bot commented Jun 9, 2026

Copy link
Copy Markdown

This pull request has been marked stale because it has been open for 10 days with no activity

@github-actions github-actions Bot added the Stale label Jun 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:S This PR changes 10-29 lines, ignoring generated files. Stale

Projects

Status: No status

Development

Successfully merging this pull request may close these issues.

BUG - Scorecard version v5.5.0 doesn't work anymore with GitLab projects

2 participants