fix: wire .trivyignore into scan/publish workflows - #491
Merged
Conversation
image-security-scan.yml's scheduled scan step never passed a trivyignores input to trivy-action, and publish-images.yml's pre-push gate used the wrong input name (ignorefile instead of trivyignores). Both silently ignored .trivyignore, so the CVE-2026-53612/53613/53614 exceptions added in #484 never took effect and the daily scan kept refiling duplicate issues. Closes #481, Closes #482, Closes #483, Closes #485, Closes #486, Closes #487 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
test_publish_images_workflow.py previously enshrined the ignorefile typo as expected behavior; update it and add a regression assertion in test_image_security_scan_workflow.py to lock in trivyignores. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Root-causes and fixes why the daily image scan keeps refiling the same three util-linux CVEs as duplicate issues (#481, #482, #483, #485, #486, #487) even though #484 already added the documented
.trivyignoreexceptions forCVE-2026-53612/53613/53614(exp 2026-11-15).image-security-scan.yml: the scheduled scan step'strivy-actioninvocation never passed atrivyignoresinput at all —.trivyignorewas silently never applied to the daily rescan.publish-images.yml: the pre-push gate passedignorefile: .trivyignore, but that input doesn't exist onaquasecurity/trivy-action@v0.36.0(the real input istrivyignores); GitHub Actions silently drops unknownwith:keys, so this gate also never honored the exception file.Both are fixed to pass
trivyignores: .trivyignore, matching the working usage already present in the otherpublish-images.ymlgate step.Type Of Change
User Impact
No CLI runtime behavior change. Once merged, the next scheduled Image Security Scan run and the
publish-images.ymlpre-push gate will actually honor the already-approved, unexpired.trivyignoreexceptions, so duplicate vuln-scan issues stop being filed for CVEs that are already tracked and excepted perdocs/image-scanning.md.Validation
python3 -c "import yaml; yaml.safe_load(...)"on both workflow files — valid YAML.yamllint .— clean (only pre-existing warnings inside.venv, not repo files).npx markdownlint-cli@0.49.0— clean.aquasecurity/trivy-action@v0.36.0'saction.yaml/entrypoint.shthattrivyignores(notignorefile) is the only input that setsTRIVY_IGNOREFILE, and that the scan step inimage-security-scan.ymlpreviously passed neither.Checklist
Closes #481
Closes #482
Closes #483
Closes #485
Closes #486
Closes #487