lebaudantoine 22adccb353 👷(ci) ignore unfixed Debian CVEs in trivy scans ...

The trivy scan fails on HIGH vulnerabilities found in the Debian 13
base images (util-linux, acl, ncurses, systemd and perl-base). None
of them has a fixed version available yet, so there is nothing we
can upgrade to clear them.

List these CVEs in a shared .github/.trivyignore and pass it to
every image scan, so the scan stays blocking for any new HIGH or
CRITICAL vulnerability. Remove the entries once Debian ships a fix.

2026-10-01 00:13:36 +02:00

..

workflows

👷(ci) ignore unfixed Debian CVEs in trivy scans

2026-10-01 00:13:36 +02:00

.trivyignore

👷(ci) ignore unfixed Debian CVEs in trivy scans

2026-10-01 00:13:36 +02:00

zizmor.yml

👷(ci) add Menshen scan for GitHub Actions vulnerabilities

2026-10-01 00:13:36 +02:00