trivy-action
trivy-action copied to clipboard
trivyignores does not support yaml/json and non-yaml files
Issue
The current version of the trivy action does not take into account that Trivy only supports YAML/JSON if the file has the suffix .yaml|.json
so when you put the following into the action parameters
trivyignores: "./.trivyignore.yaml"
it makes a file that is with out a .yaml|.json
ending. This as a result makes trivy not read the file and ignore the input.
reproduction of issue
I have created a repo with the files to demonstrate this
https://github.com/gamethis/trivy_issues
you can see the scenario by running trivy.sh
it will work.
if you run trivy_fail.sh
it will simulate what the action does currently and will fail.
Desired Action outcome
Would like to see an action updated to either check for yaml|json
and add another --ignorefile .trivyignores.yaml to use
or an input parameter that will allow for yaml|json
style ignore files.