fix(security): scope Trivy private-key ignore to vendored openssl doc (false positive)

.trivyignore.yaml

@@ -0,0 +1,22 @@
+# Trivy ignore rules (.trivyignore.yaml)
+#
+# Loaded via trivy.yaml (`ignorefile: .trivyignore.yaml`) so it applies to a
+# bare `trivy fs .`. Trivy 0.71.x only auto-detects a plain `.trivyignore`
+# (line-based, NO path scoping); the YAML form used here is what lets us scope
+# the suppression to a single path instead of disabling a rule globally.
+#
+# Scope: ONE path-scoped secret suppression. This does NOT globally disable
+# private-key detection — a real private key committed anywhere else in the
+# repo will still fail the scan.
+#
+# Why this single entry is safe (verified false positive):
+#   The R "openssl" package is vendored under packrat/ for reproducible builds.
+#   Its bundled upstream HTML docs (openssl/doc/keys.html) print an EXAMPLE PEM
+#   key from the doc's own `write_pem()` demonstration. It is published upstream
+#   example material, not a live credential, so Trivy's Secret rule "private-key"
+#   (AsymmetricPrivateKey, HIGH) is a false positive here. We scope the ignore to
+#   exactly this vendored doc path.
+secrets:
+  - id: private-key
+    paths:
+      - "packrat/lib/**/openssl/doc/keys.html"

trivy.yaml

@@ -0,0 +1,8 @@
+# Trivy configuration (auto-loaded from the repo root by `trivy fs .`).
+#
+# Its only job is to activate the path-scoped secret suppression in
+# .trivyignore.yaml. Trivy 0.71.x auto-detects only a plain `.trivyignore`
+# (which cannot scope a rule to a path); pointing `ignorefile` at the YAML file
+# lets us suppress the vendored-doc false positive WITHOUT globally disabling
+# private-key detection. See .trivyignore.yaml for the full justification.
+ignorefile: .trivyignore.yaml