feat: add --exclude flag to skip paths during scanning #2458

Ankitsinghsisodya · 2026-01-10T23:08:07Z

Overview

Issue: #2324

This PR adds a --exclude CLI flag that allows users to specify glob patterns to exclude files and directories from vulnerability scanning.

Fixes #2324

Details

Problem

Users scanning large repositories often want to exclude test files, documentation, and other non-production code from vulnerability scans. While .gitignore is respected by default and osv-scanner.toml can be used, there was no quick CLI option to exclude paths.

Solution

Added --exclude / -e flag that accepts glob patterns:

osv-scanner scan source -r --exclude="**/test/**" --exclude="**/docs/**" ./path

Add --exclude/-e CLI flag that accepts glob patterns to exclude files and directories from vulnerability scanning. This addresses user requests to easily skip test files and documentation during scans. Changes: - Add ExcludePatterns field to ScannerActions struct - Add --exclude flag to scan source command - Wire ExcludePatterns to scalibr's SkipDirGlob option - Document the new flag in scan-source.md Fixes google#2324

another-rex

This is definitely something we want, though might need a bit more design before including it. It is really hard for us to justify removing a flag once it's added.

I want a way for people to specify regex patterns without having to add another separate flag. Maybe something like if it is wrapped /<regex>/ like in javascript?

…at/exclude-paths-flag

- Replace regexp import with cachedregexp to satisfy depguard rules - Add Regexp type alias and Compile function to cachedregexp package - Remove duplicate package doc comment (godoclint) - Add blank line before return (nlreturn) - Add t.Parallel() calls to test functions (paralleltest)

G-Rath

Appreciate your work on this!

Could you please:

move the flag to be --experimental- (this is mainly because right now scalibr only supports skipping directories, not files which'll hopefully be able to change but in the meantime this will mean we can do breaking changes if we go another direction instead)
update the docs to reflect that this only applies to directories, not files
add a couple of cmd tests
update the syntax to use :, matching our --lockfile flag, which'll also let us use DirsToSkip too
- if the string is prefixed with : or nothing, it should be applied as a directory (DirsToSkip)
- if the string is prefixed with g:, it should be applied as a glob (SkipDirGlob)
- if the string is prefixed with r:, it should be applied as a regex (SkipDirRegex)

internal/cachedregexp/regex.go

another-rex · 2026-01-20T03:17:56Z

if the string is prefixed with :, it should be applied as a directory (DirsToSkip)

to clarify, also if it is not prefixed, use DirsToSkip, the prefixing with : is just an escape hatch incase your file path itself has a : inside.

…it glob, regex, and exact match patterns.

…or exact, glob, and regex patterns, and update `go.mod` to directly import `gobwas/glob`.

…-dir arguments and patterns.

Ankitsinghsisodya · 2026-01-20T07:32:03Z

@another-rex sir, I have done the changes suggested you.

…o exclude directories during scanning.

internal/cachedregexp/regex.go

pkg/osvscanner/osvscanner.go

pkg/osvscanner/scan.go

pkg/osvscanner/exclude_test.go

pkg/osvscanner/exclude.go

cmd/osv-scanner/mcp/integration_test.go

… to experimental actions.

… integration test.

Ankitsinghsisodya · 2026-01-20T19:42:46Z

I initially removed the type alias as you suggested, but CI failed with a depguard error:

import 'regexp' is not allowed from list 'regexp':
Use github.com/google/osv-scanner/v2/internal/cachedregexp instead (depguard)

The exclude.go file needs the *regexp.Regexp type for the struct field, but can't import regexp directly due to the lint rule. Adding the type alias back in cachedregexp allows other packages to use *cachedregexp.Regexp without violating depguard.

Should I look into adding an exception to the depguard config for this file, or is the type alias acceptable given this constraint?

G-Rath · 2026-01-20T19:58:06Z

right yeah of course - I think for now let's go with adding the exception as that mirrors what we're doing elsewhere for this situation, though I think I'll revisit that after this as it'll probably be better to just re-export stuff from cachedregexp and/or try to use the forbidigo linter instead

(I had forgotten we pretty much don't use regexp outside of cachedregexp.MustCompile 😅)

…r's `regexp` package usage check.

G-Rath

looking good, we just also do want to change the cmd flag to use exclude too

cmd/osv-scanner/scan/source/command.go

cmd/osv-scanner/scan/source/command_test.go

pkg/osvscanner/exclude_test.go

Co-authored-by: Gareth Jones <3151613+G-Rath@users.noreply.github.com>

…e` and update its usage and documentation.

… multiple flags.

…parseExcludePatterns` test.

another-rex

Looks good!

cmd/osv-scanner/scan/source/command.go

another-rex · 2026-01-21T00:28:11Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces a new experimental flag --experimental-exclude to allow excluding paths from scanning. The implementation is well-structured, with new logic for parsing exclusion patterns, comprehensive tests, and clear documentation. I've found one issue with how absolute paths are handled, which could lead to silent failures. My detailed feedback is in the review comments. Also, note that the PR description and title mention --exclude, but the implementation uses --experimental-exclude, which is correctly reflected in the documentation.

pkg/osvscanner/exclude.go

another-rex · 2026-01-21T00:59:15Z

Hmm the requested interactions not found errors are a bit odd in the CI, because it looks like you have added the new interactions to the cassettes. @G-Rath Can you take a look at why that could be happening?

G-Rath · 2026-01-21T01:11:39Z

I think they might just need to be regenerated, as they're still using the old X-Test-Name and it doesn't look like there are interactions for the exclude_with_multiple_exact_directories and exclude_with_multiple_pattern_types tests.

First I'd do is just revert all changes to cmd/osv-scanner/scan/source/testdata/cassettes/TestCommand.yaml, re-run the suite, and commit the results

another-rex reviewed Jan 13, 2026

View reviewed changes

Ankitsinghsisodya added 3 commits January 14, 2026 12:01

feat: add --exclude flag with glob and regex support

f0aa799

Merge remote-tracking branch 'origin/feat/exclude-paths-flag' into fe…

d7e12fd

…at/exclude-paths-flag

G-Rath requested changes Jan 20, 2026

View reviewed changes

internal/cachedregexp/regex.go Outdated Show resolved Hide resolved

Ankitsinghsisodya added 4 commits January 20, 2026 12:20

Merge branch 'main' into feat/exclude-paths-flag

d35d194

feat: Implement experimental skip directory functionality with explic…

4223e6c

…it glob, regex, and exact match patterns.

feat: Add tests for the experimental --skip-dir flag with support f…

eab9cc8

…or exact, glob, and regex patterns, and update `go.mod` to directly import `gobwas/glob`.

feat: Implement and test directory exclusion functionality using skip…

65a8186

…-dir arguments and patterns.

feat: Add --experimental-skip-dir flag with regex pattern support t…

edbbe2d

…o exclude directories during scanning.

G-Rath requested changes Jan 20, 2026

View reviewed changes

Ankitsinghsisodya added 5 commits January 21, 2026 00:40

refactor: rename skip directory patterns to exclude patterns and move…

1138b63

… to experimental actions.

refactor: streamline exclude patterns initialization and error handling

b508b49

refactor: Rename test case names to snake_case for consistency.

a954c7e

refactor: unexport exclude pattern types and functions for internal use.

cd30159

chore: Remove redundant vulnerability ID check and unused import from…

772c5a0

… integration test.

Ankitsinghsisodya requested a review from G-Rath January 20, 2026 19:22

build: Exclude pkg/osvscanner/exclude.go from the forbidigo linte…

0bc9ca0

…r's `regexp` package usage check.

G-Rath requested changes Jan 20, 2026

View reviewed changes

G-Rath assigned G-Rath and unassigned G-Rath Jan 20, 2026

Ankitsinghsisodya and others added 4 commits January 21, 2026 01:59

Update pkg/osvscanner/exclude_test.go

c783f97

Co-authored-by: Gareth Jones <3151613+G-Rath@users.noreply.github.com>

Update pkg/osvscanner/exclude_test.go

78d51d8

Co-authored-by: Gareth Jones <3151613+G-Rath@users.noreply.github.com>

refactor: rename experimental-skip-dir flag to `experimental-exclud…

e7ac260

…e` and update its usage and documentation.

test: update experimental-exclude flag test names and add cases for…

0ef512f

… multiple flags.

refactor: Remove redundant boolean flags and simplify assertions in `…

c8e92a9

…parseExcludePatterns` test.

Ankitsinghsisodya requested a review from G-Rath January 20, 2026 20:47

Merge branch 'main' into feat/exclude-paths-flag

a2aeb05

another-rex approved these changes Jan 21, 2026

View reviewed changes

cmd/osv-scanner/scan/source/command.go Outdated Show resolved Hide resolved

gemini-code-assist bot reviewed Jan 21, 2026

View reviewed changes

pkg/osvscanner/exclude.go Show resolved Hide resolved

Update cmd/osv-scanner/scan/source/command.go

3dc8bac

feat: add --exclude flag to skip paths during scanning #2458

Are you sure you want to change the base?

feat: add --exclude flag to skip paths during scanning #2458

Uh oh!

Conversation

Ankitsinghsisodya commented Jan 10, 2026

Overview

Details

Problem

Solution

Uh oh!

another-rex left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

G-Rath left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

another-rex commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Ankitsinghsisodya commented Jan 20, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Ankitsinghsisodya commented Jan 20, 2026

Uh oh!

G-Rath commented Jan 20, 2026

Uh oh!

G-Rath left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

another-rex left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

another-rex commented Jan 21, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

another-rex commented Jan 21, 2026

Uh oh!

G-Rath commented Jan 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

another-rex left a comment •

edited

Loading

G-Rath left a comment •

edited

Loading

another-rex commented Jan 20, 2026 •

edited

Loading