From be7a65bdb95777417005eff152eff5ee9b6d03a3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Fri, 6 Nov 2026 20:19:51 +0100 Subject: [PATCH] ci(trivy): report only fixable findings from the published-image scan --- .github/workflows/trivy.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index dfdad5f61..a9169883b 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -142,6 +142,13 @@ jobs: output: trivy-published-image.sarif severity: "CRITICAL,HIGH,MEDIUM" limit-severities-for-sarif: true + # Only findings with a published fix reach code scanning. Debian + # leaves many base-package advisories unfixed in stable (no-dsa, + # postponed), and nothing in this repository can act on those: the + # build's `apt-get upgrade` takes the fix the day Debian ships one, + # and that is when the alert should appear. Listing them all made + # the page a hundred-odd rows deep without one to act on. + ignore-unfixed: true exit-code: "0" - name: Upload results @@ -162,6 +169,6 @@ jobs: format: table severity: "CRITICAL" exit-code: "1" - # Same rule as the blocking gate in security.yml: a finding with a - # published fix fails, one without is in the SARIF report above. + # Same rule as the blocking gate in security.yml and the SARIF + # report above: only a finding with a published fix counts. ignore-unfixed: true