.trivyignore

# Trivy ignore file for security scan exceptions
# Only ignore false positives - real security issues should still fail the build

# Common Kubernetes/Helm false positives
KSV001  # Process should not run as root
KSV003  # Default capabilities should be dropped
KSV011
KSV012  # Runs as root user
KSV0125  # Untrusted registry
KSV014  # Root filesystem is not read-only
KSV015
KSV016
KSV017
KSV018
KSV020  # Runs with UID <= 10000
KSV021
KSV030
KSV104  # Seccomp profile is not explicitly set
KSV106  # Container does not drop all default capabilities
KSV110
KSV112
KSV116  # Runs with a root primary or supplementary GID
KSV117
KSV118

# Docker/Container security false positives
DS002   # Container should drop all capabilities
DS026   # Container should not run as root
DS014   # Container should not run with allowPrivilegeEscalation
DS013   # Container should not run with write access to root filesystem
DS001   # Process should not run as root
DS025   # Container should not run with NET_RAW capability
DS029   # Container should not run with SYS_ADMIN capability

# GitHub Actions workflow false positives
GHA001  # GitHub Actions should not have write permissions
GHA002  # GitHub Actions should use pinned versions

# Ignore all misconfig findings for Helm templates (they are configured via values)
# This is a broad ignore for Helm template patterns
*.yaml:*
*.yml:*