From afa14ffac9b0acf7a7296e7fe8c6c6e7997ad9fd Mon Sep 17 00:00:00 2001 From: Kangyan-Zhou Date: Wed, 1 Apr 2026 21:41:16 -0700 Subject: [PATCH] Skip Go stdlib and NVIDIA tool CVEs in Trivy scan (#21905) Co-authored-by: Claude Opus 4.6 (1M context) --- .github/workflows/trivy-scan-dev.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/trivy-scan-dev.yml b/.github/workflows/trivy-scan-dev.yml index 87a566f88..1f73a65c4 100644 --- a/.github/workflows/trivy-scan-dev.yml +++ b/.github/workflows/trivy-scan-dev.yml @@ -36,6 +36,7 @@ jobs: output: 'trivy-results-${{ matrix.tag }}.sarif' severity: 'CRITICAL,HIGH' ignore-unfixed: true + skip-dirs: 'usr/local/go,opt/nvidia' - name: Upload Trivy scan results to GitHub Security uses: github/codeql-action/upload-sarif@v4 @@ -53,6 +54,7 @@ jobs: format: 'table' severity: 'CRITICAL,HIGH' ignore-unfixed: true + skip-dirs: 'usr/local/go,opt/nvidia' - name: Scan summary if: always()