trivy-action icon indicating copy to clipboard operation
trivy-action copied to clipboard

trivyignores does not support yaml/json and non-yaml files

Open gamethis opened this issue 1 year ago • 5 comments

Issue

The current version of the trivy action does not take into account that Trivy only supports YAML/JSON if the file has the suffix .yaml|.json so when you put the following into the action parameters

trivyignores: "./.trivyignore.yaml"

it makes a file that is with out a .yaml|.json ending. This as a result makes trivy not read the file and ignore the input.

reproduction of issue

I have created a repo with the files to demonstrate this

https://github.com/gamethis/trivy_issues

you can see the scenario by running trivy.sh it will work. if you run trivy_fail.sh it will simulate what the action does currently and will fail.

Desired Action outcome

Would like to see an action updated to either check for yaml|json and add another --ignorefile .trivyignores.yaml to use or an input parameter that will allow for yaml|json style ignore files.

gamethis avatar Nov 20 '23 23:11 gamethis