mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
bc9d18457d
The advisory Trivy image scan uploaded every HIGH/CRITICAL into the Security tab without ignore-unfixed, flooding it with ~150 unfixable base-image OS CVEs (Debian trixie packages with no upstream patch, overwhelmingly local-only and not reachable from the proxy request surface). Operators cannot act on those, so they are pure noise. Add ignore-unfixed:true to the advisory step so it mirrors the existing CRITICAL blocking gate and surfaces only actionable, fixable vulnerabilities. Wire trivyignores to a new repo-root .trivyignore that documents the accepted-risk policy and is the single auditable home for the rare fixable CVE we must temporarily accept (none at present). Takes effect on the next release image build (Trivy only runs on tag builds, not main pushes); fixed CVEs drop out of the SARIF and GitHub auto-resolves the corresponding alerts.
23 lines
1.2 KiB
Plaintext
23 lines
1.2 KiB
Plaintext
# .trivyignore — accepted-risk suppressions for the container image scan
|
|
#
|
|
# Policy (see docs/security/SUPPLY_CHAIN.md):
|
|
# - The Trivy steps in .github/workflows/docker-publish.yml run with
|
|
# `ignore-unfixed: true`, so vulnerabilities WITHOUT a published fix are
|
|
# already excluded from both the blocking CRITICAL gate and the advisory
|
|
# Security-tab upload. You do NOT need an entry here for an unfixable
|
|
# base-image OS CVE — it will not be reported.
|
|
# - This file is the single auditable home for the rare case where a *fixable*
|
|
# CVE must be temporarily accepted (e.g. the upstream fix is not yet in the
|
|
# pinned base tag, or the affected package/binary is provably unreachable
|
|
# from the proxy request surface and rebuilding now is not justified).
|
|
#
|
|
# Format — one CVE id per line, each with a justification comment and, where
|
|
# possible, an expiry, e.g.:
|
|
# # CVE-XXXX-YYYY — <why accepted>; revisit on next base-image bump (YYYY-MM-DD)
|
|
# CVE-XXXX-YYYY
|
|
#
|
|
# Keep this list SHORT and reviewed every release. Prefer fixing (rebuild on a
|
|
# patched base / bump the dep) over suppressing. Stale entries are debt.
|
|
#
|
|
# (No accepted-risk suppressions at present — ignore-unfixed covers the noise.)
|