From 7eba5e10fab8ab90b434fd42b9377a10a7b36850 Mon Sep 17 00:00:00 2001
From: Vincent Potucek <vpotucek@me.com>
Date: Wed, 12 Nov 2025 17:20:53 +0100
Subject: [PATCH] [trivy] add `trivy-maven-plugin`

Signed-off-by: Vincent Potucek <vpotucek@me.com>
---
 .github/workflows/ci.yml |  3 +++
 .trivyignore             |  7 +++++++
 boms/pom.xml             |  5 -----
 pom.xml                  | 10 ++++++++++
 4 files changed, 20 insertions(+), 5 deletions(-)
 create mode 100644 .trivyignore

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ada5dd74f089..eec199e20115 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -97,6 +97,9 @@ jobs:
       - name: Build Keycloak
         uses: ./.github/actions/build-keycloak
 
+      - name: Trivy
+        run: ./mvnw trivy:trivy-scan
+
       - name: Check for unstaged proto.lock files
         if: github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release/')
         run: git diff --name-only --exit-code -- "**/proto.lock"
diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 000000000000..bc372c40a69c
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1,7 @@
+CVE-2015-7501
+CVE-2019-17571
+CVE-2022-23305
+CVE-2022-23307
+CVE-2022-4492
+CVE-2022-45047
+CVE-2024-52046
\ No newline at end of file
diff --git a/boms/pom.xml b/boms/pom.xml
index a9f5de04ddb8..f27ad3c117f7 100644
--- a/boms/pom.xml
+++ b/boms/pom.xml
@@ -78,11 +78,6 @@
                         <nexusUrl>${jboss.repo.nexusUrl}</nexusUrl>
                     </configuration>
                 </plugin>
-                <plugin>
-                    <groupId>com.diffplug.spotless</groupId>
-                    <artifactId>spotless-maven-plugin</artifactId>
-                    <version>${spotless-plugin.version}</version>
-                </plugin>
             </plugins>
         </pluginManagement>
     </build>
diff --git a/pom.xml b/pom.xml
index d3cabd03cb9f..f616a5a78507 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1557,6 +1557,16 @@
                         </java>
                     </configuration>
                 </plugin>
+                <plugin>
+                    <groupId>tech.orla</groupId>
+                    <artifactId>trivy-maven-plugin</artifactId>
+                    <version>1.0.1</version>
+                    <configuration>
+                        <ignoreUnfixed>true</ignoreUnfixed>
+                        <severity>CRITICAL</severity>
+                        <vulnType>os,library</vulnType>
+                    </configuration>
+                </plugin>
             </plugins>
         </pluginManagement>