scope pipelines, allowlist go CVE

Author: Jyothirmaikottu

.github/workflows/vllm.pr-amzn2023.yml

@@ -13,6 +13,8 @@ on:
       - "scripts/docker/common/**"
       - "scripts/docker/telemetry/**"
       - "scripts/docker/vllm/**"
+      # omni_* scripts belong to vllm_omni only
+      - "!scripts/docker/vllm/omni_*"
       - "test/efa/**"
       - "test/sanity/**"
       - "test/security/data/ecr_scan_allowlist/vllm_server/**"

.github/workflows/vllm.pr-ubuntu.yml

@@ -13,6 +13,8 @@ on:
       - "scripts/docker/common/**"
       - "scripts/docker/telemetry/**"
       - "scripts/docker/vllm/**"
+      # omni_* scripts belong to vllm_omni only
+      - "!scripts/docker/vllm/omni_*"
       - "test/efa/**"
       - "test/sanity/**"
       - "test/security/data/ecr_scan_allowlist/vllm/**"

test/security/data/ecr_scan_allowlist/vllm_omni/framework_allowlist.json

@@ -69,6 +69,11 @@
         "reason": "go/stdlib in mooncake/libetcd_wrapper.so, unpatchable without mooncake upgrade",
         "review_by": "2026-08-25"
     },
+    {
+        "vulnerability_id": "CVE-2026-27145",
+        "reason": "go/stdlib in mooncake/libetcd_wrapper.so, unpatchable without mooncake upgrade",
+        "review_by": "2026-08-25"
+    },
     {
         "vulnerability_id": "RUSTSEC-2026-0185",
         "reason": "quinn-proto in uv binary, upstream uv has not released a fix yet",