trivy.yaml

# SPDX-FileCopyrightText: (C) 2026 Intel Corporation
#
# SPDX-License-Identifier: Apache-2.0

---
scan:
  skip-dirs:
    - vendor
    - test
    - app-orch-tutorials
  skip-check-ids:
    - KSV110   # Helm sets namespace at install time; no hardcoded default namespace
    - KSV-0110  # alternate rule ID for the same check
    - KSV0125  # image registry is templated via .Values.image.registry; resolved at deploy time
    - KSV-0125  # alternate rule ID for the same check
    - KSV021   # runAsGroup is set to 65532 (> 10000) via catalogSecurityContext in values.yaml; Trivy false positive on templated Helm values
    - KSV-0021  # alternate rule ID for the same check
    - CVE-2025-58767  # rexml in golang builder base image only; absent from final distroless/static image