Suppress IN-DISCONTINUED-001 finding in ECR image scan gate

Amazon Linux 2 reached end-of-life on June 30, 2026. Inspector2 now
flags all AL2-based images with IN-DISCONTINUED-001 at CRITICAL severity,
which blocks the 2.x release pipeline.

This is an informational finding about the OS lifecycle status, not an
exploitable vulnerability. The 2.x image line is already documented as
EOL-mirroring AL2, and customers have been advised to migrate to 3.x.

Add a NOT_EQUALS filter for IN-DISCONTINUED-001 to the Inspector2
list-findings call in verify_ecr_image_scan() so the 2.x maintenance
builds can continue shipping until the line is formally deprecated.

Author: prateekchaudhry

scripts/publish.sh

@@ -741,7 +741,7 @@ verify_ecr_image_scan() {
 			max_stability_attempts=10
 			stability_attempt=0
 			while [ $stability_attempt -lt $max_stability_attempts ]; do
-				findings=$(aws inspector2 list-findings --max-results 1 --filter-criteria '{"ecrImageRepositoryName":[{"comparison":"EQUALS","value":"'${repo_uri}'"}],"ecrImageTags":[{"comparison":"EQUALS","value":"'${tag}'"}],"severity":[{"comparison":"EQUALS","value":"HIGH"},{"comparison":"EQUALS","value":"CRITICAL"}]}' --region ${region})
+				findings=$(aws inspector2 list-findings --max-results 1 --filter-criteria '{"ecrImageRepositoryName":[{"comparison":"EQUALS","value":"'${repo_uri}'"}],"ecrImageTags":[{"comparison":"EQUALS","value":"'${tag}'"}],"severity":[{"comparison":"EQUALS","value":"HIGH"},{"comparison":"EQUALS","value":"CRITICAL"}],"vulnerabilityId":[{"comparison":"NOT_EQUALS","value":"IN-DISCONTINUED-001"}]}' --region ${region})
 				vulnerability=$(echo "$findings" | jq '.findings | length')
 				if [ $vulnerability -gt 0 ]; then
 					echo "Uploaded image ${tag} has HIGH/CRITICAL vulnerabilities."