From f71a32cff58a797b976421bfafa5da0011062499 Mon Sep 17 00:00:00 2001
From: Matt Collins <matt.collins@thetradedesk.com>
Date: Mon, 2 Nov 2026 03:00:06 +0000
Subject: [PATCH] UID2-7861: apply .trivyignore.rego ignore policy when present

Lets a repo ignore all findings for a named package, not one CVE at a time.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 actions/vulnerability_scan/action.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/actions/vulnerability_scan/action.yaml b/actions/vulnerability_scan/action.yaml
index 5273695c..50c5e7ae 100644
--- a/actions/vulnerability_scan/action.yaml
+++ b/actions/vulnerability_scan/action.yaml
@@ -95,6 +95,8 @@ runs:
     env:
       TRIVY_SKIP_DB_UPDATE: true
       TRIVY_SKIP_JAVA_DB_UPDATE: true
+      # Rego policy to ignore findings by package; optional, like .trivyignore.
+      TRIVY_IGNORE_POLICY: ${{ hashFiles('.trivyignore.rego') != '' && '.trivyignore.rego' || '' }}
 
   - name: Create SARIF report
     if: inputs.publish_vulnerabilities == 'true'