[mcollins-ttd]

Lets a repo ignore all findings for a named package (e.g. an unreachable Alpine OS library) with a .trivyignore.rego Rego policy, instead of adding each new CVE to .trivyignore.

• The scan step sets TRIVY_IGNORE_POLICY when .trivyignore.rego exists at the repo root, like Trivy's own .trivyignore lookup. Repos without the file are unchanged.
• Only the scan step needs it: later steps run trivy convert on its JSON, so the findings drop out of the SARIF, fail-only report and fail check too.
• Tested with a copy of this action against the uid2-core base image: with a libexpat policy, all libexpat findings are gone and other findings are unchanged; without the file, results are unchanged.

Example policy:

package trivy

import rego.v1

default ignore := false

ignore if {
	input.PkgName == "libexpat"
	startswith(input.PkgIdentifier.PURL, "pkg:apk/")
}

🤖 Generated with Claude Code