Possible to use multiple .trivyignore files?

[viktorgunnarson]

Question

I wonder if it possible to somehow use multiple .trivyignore files in combination? Our case is that we have a bunch of similar services in separate repos where we would like to have a "global" ignore file for ignoring common false-positives and also local ignore files for false-positives specific to a single service.

Mode

Standalone

Version

$ trivy --version
Version: 0.50.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-03-26 06:11:10.197763384 +0000 UTC
  NextUpdate: 2024-03-26 12:11:10.197763094 +0000 UTC
  DownloadedAt: 2024-03-26 07:49:12.631242 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-03-25 00:45:09.004879026 +0000 UTC
  NextUpdate: 2024-03-28 00:45:09.004878766 +0000 UTC
  DownloadedAt: 2024-03-25 13:51:56.465349 +0000 UTC

[DmitriyLewen]

Hello @viktorgunnarson
Thanks for your interest to Trivy!

Unfortunately Trivy doesn't have the ability to use multiple ignore files.
But there is #6338 for rego files.

Regards, Dmitriy

[beaglemarauder]

Is there a way you can use a global .trivyignore file in a composite action for centralised reuse?

[DmitriyLewen]

You can set path to global .trivyignore file using --ignorefile flag.