Add OSV Scanner config for test fixtures

[el kampu (elkampu)]

Summary

• Add osv-scanner.toml beside each test fixture directory currently reported by the Scorecard vulnerability check.
• Ignore individual advisory IDs only; no package-wide or repository-wide suppressions are used.
• Cover the verification resources and the two detector-report mocks that the same repository scan detects.

OSV Scanner configuration is directory-local and does not propagate to child directories, so repeated fixture layouts need colocated files. Each ignore records that the dependency is intentionally outdated test data that is not built or shipped.

Closes #1073

Validation

• OpenSSF Scorecard v5.3.0 Vulnerabilities: 10/10, 0 existing vulnerabilities detected
• OSV Scanner v2.5.1: zero vulnerability results (the process still reports fixture-resolution errors for intentionally invalid Maven/Pip inputs)
• OSV Scanner v1.9.2: zero non-Go findings; the remaining Go standard-library findings are filtered by Scorecard
• Negative control: applying one fixture config to a different vulnerable manifest still reports unrelated advisories
• Restore and build with the repository-pinned .NET 8.0.424 SDK: passed with zero warnings/errors using EnforceCodeStyleInBuild=false
• Verification-test project build: passed with zero warnings/errors
• Default tests: 1,430 passed, 7 skipped; the sole failure was DockerService_CanPingDockerAsync because Docker is unavailable on the test host
• git diff --check

The unmodified build command also reports pre-existing IDE suggestions as errors in unchanged C# files on this Windows checkout; upstream CI is green on the same base commit.

[Copilot]

🟢 Approval recommended

The changes only add directory-scoped OSV Scanner configuration for non-shipping test fixtures/mocks and do not alter product code or detector behavior.

Pull request overview

Adds directory-local osv-scanner.toml configuration files alongside existing test/fixture content so OpenSSF Scorecard and OSV Scanner don’t report known-vulnerable (but intentionally outdated and non-shipping) verification resources and detector-report mocks as repository vulnerabilities.

Changes:

• Add per-directory OSV Scanner ignore lists for advisories triggered by intentionally outdated verification test fixtures.
• Add OSV Scanner ignore lists for two detector test mock directories that appear in repository-wide scans.
• Document the suppression rationale consistently via per-advisory reason entries (no package-wide/repo-wide suppressions).

File summaries

File	Description
test/Microsoft.ComponentDetection.VerificationTests/resources/yarn/v2/osv-scanner.toml	Local OSV ignore list for Yarn v2 fixtures.
test/Microsoft.ComponentDetection.VerificationTests/resources/yarn/v1/osv-scanner.toml	Local OSV ignore list for Yarn v1 fixtures.
test/Microsoft.ComponentDetection.VerificationTests/resources/uv/osv-scanner.toml	Local OSV ignore list for uv fixtures.
test/Microsoft.ComponentDetection.VerificationTests/resources/rust/workspaces/osv-scanner.toml	Local OSV ignore list for Rust workspace fixtures.
test/Microsoft.ComponentDetection.VerificationTests/resources/rust/standard/osv-scanner.toml	Local OSV ignore list for standard Rust fixtures.
test/Microsoft.ComponentDetection.VerificationTests/resources/poetry/osv-scanner.toml	Local OSV ignore list for Poetry fixtures.
test/Microsoft.ComponentDetection.VerificationTests/resources/pnpm/v6/osv-scanner.toml	Local OSV ignore list for pnpm v6 fixtures.
test/Microsoft.ComponentDetection.VerificationTests/resources/pnpm/v5/osv-scanner.toml	Local OSV ignore list for pnpm v5 fixtures.
test/Microsoft.ComponentDetection.VerificationTests/resources/pip/roots/osv-scanner.toml	Local OSV ignore list for pip “roots” fixtures.
test/Microsoft.ComponentDetection.VerificationTests/resources/pip/pre-generated/simple/osv-scanner.toml	Local OSV ignore list for pre-generated pip “simple” fixtures.
test/Microsoft.ComponentDetection.VerificationTests/resources/pip/pre-generated/multiple/osv-scanner.toml	Local OSV ignore list for pre-generated pip “multiple” fixtures.
test/Microsoft.ComponentDetection.VerificationTests/resources/pip/pre-generated/invalid/osv-scanner.toml	Local OSV ignore list for pre-generated pip “invalid” fixtures.
test/Microsoft.ComponentDetection.VerificationTests/resources/pip/parallel/parallel-test-5/osv-scanner.toml	Local OSV ignore list for pip parallel test fixture 5.
test/Microsoft.ComponentDetection.VerificationTests/resources/pip/parallel/parallel-test-4/osv-scanner.toml	Local OSV ignore list for pip parallel test fixture 4.
test/Microsoft.ComponentDetection.VerificationTests/resources/pip/parallel/parallel-test-3/osv-scanner.toml	Local OSV ignore list for pip parallel test fixture 3.
test/Microsoft.ComponentDetection.VerificationTests/resources/pip/parallel/parallel-test-2/osv-scanner.toml	Local OSV ignore list for pip parallel test fixture 2.
test/Microsoft.ComponentDetection.VerificationTests/resources/pip/parallel/parallel-test-1/osv-scanner.toml	Local OSV ignore list for pip parallel test fixture 1.
test/Microsoft.ComponentDetection.VerificationTests/resources/pip/osv-scanner.toml	Local OSV ignore list for pip fixtures at resources/pip.
test/Microsoft.ComponentDetection.VerificationTests/resources/pip/index-removal/osv-scanner.toml	Local OSV ignore list for pip index-removal fixture.
test/Microsoft.ComponentDetection.VerificationTests/resources/pip/fallback/osv-scanner.toml	Local OSV ignore list for pip fallback fixture.
test/Microsoft.ComponentDetection.VerificationTests/resources/npm/shrinkwrap/osv-scanner.toml	Local OSV ignore list for npm shrinkwrap fixtures.
test/Microsoft.ComponentDetection.VerificationTests/resources/npm/lockfile3/osv-scanner.toml	Local OSV ignore list for npm lockfile v3 fixtures.
test/Microsoft.ComponentDetection.VerificationTests/resources/npm/lockfile/osv-scanner.toml	Local OSV ignore list for npm lockfile fixtures.
test/Microsoft.ComponentDetection.VerificationTests/resources/gradle/osv-scanner.toml	Local OSV ignore list for Gradle fixtures.
test/Microsoft.ComponentDetection.VerificationTests/resources/go/osv-scanner.toml	Local OSV ignore list for Go fixtures.
test/Microsoft.ComponentDetection.Detectors.Tests/Mocks/InvalidJsonReport/osv-scanner.toml	Local OSV ignore list for “InvalidJsonReport” mock fixture directory.
test/Microsoft.ComponentDetection.Detectors.Tests/Mocks/EmptyReport/osv-scanner.toml	Local OSV ignore list for “EmptyReport” mock fixture directory.

Review details

• Files reviewed: 27/27 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.