trivy-ignore

Sterne13

Forks2

Aktualisiert31. März 2026 um 08:40

Handle Trivy CVE findings by adding entries to .trivyignore.yaml when no upstream fix is available. Do NOT use npm overrides to work around transitive dependency CVEs — they break cross-platform lockfile entries (e.g. rollup native binaries).

Installation

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

Quelle

bayesimpact

bayesimpact/bayes-platform

GitHub-Repository öffnen Creator-Repositorys ansehen

Download

Verwandte BerufeSOC

Basierend auf der SOC-Berufsklassifikation

SoftwareentwicklerInformatik- und Mathematikberufe·SOC 15-1252

SKILL.md

readonly

name	trivy-ignore
description	Handle Trivy CVE findings by adding entries to .trivyignore.yaml when no upstream fix is available. Do NOT use npm overrides to work around transitive dependency CVEs — they break cross-platform lockfile entries (e.g. rollup native binaries).

When Trivy (or a CI security scan) reports CVEs in JS dependencies with no clear upstream fix, add them to .trivyignore.yaml with a short expiry.

Rules

Never use npm overrides to force-patch transitive dependency versions. Overrides cause npm install to regenerate the lockfile for the current platform only, dropping cross-platform optional native binaries (e.g. @rollup/rollup-linux-x64-gnu). This breaks CI/Vercel builds on Linux.
Prefer .trivyignore.yaml with a short expiry (30-60 days) for CVEs blocked on upstream package maintainers.
Only apply direct fixes (e.g. npm audit fix without --force) if they don't introduce breaking changes.

Steps

Read the current .trivyignore.yaml file at the repo root.
For each CVE to ignore, add an entry with:
- id: the CVE identifier (e.g. CVE-2026-33671)
- expired_at: 30-60 days from today (format: YYYY-MM-DD)
- reason: a short explanation — which package, why no fix is available, what's blocking upstream
Use the Edit tool to append the new entries under the vulnerabilities: key.
Verify the YAML is valid by checking indentation matches existing entries (2-space indent, dash-prefixed list items).

Example entry

  - id: CVE-2026-33671
    expired_at: 2026-06-01
    reason: "picomatch — no upstream fix available in transitive deps (jest, vite, angular-devkit)"

Mehr aus diesem Repository

gleiches Repository

check-permission-matrix

bayesimpact/bayes-platform

Audit that docs/rbac-permission-matrix.md matches the RBAC catalog in code (roles, permissions, and grants in rbac.constants.ts and api-contracts permissions.ts). Reports every mismatch.

2026-07-3113

crud-generator

bayesimpact/bayes-platform

Generate CRUD boilerplate (backend NestJS controller/service/module/guard/policy/factory/routes/e2e + frontend Redux slice/thunks/selectors/middleware/spi/api) from a given entity file and a list of methods.

2026-07-2813

end-feature

bayesimpact/bayes-platform

Run the last steps before ending a feature. Shows a form where you can check/uncheck which final steps to run — update changelog, create a branch, run tests-parallel, create a PR — then executes the selected steps in that order.

2026-07-0913

new-issue

bayesimpact/bayes-platform

Create a GitHub issue on bayesimpact/bayes-platform from a free-text description. Drafts a clear title and structured body, picks appropriate labels, and posts it via the gh CLI, returning the issue URL. Optionally enriches the issue with context from the current codebase.

2026-07-0813

commit-name

bayesimpact/bayes-platform

Suggest a Conventional Commits message for the last changes without committing. Analyzes the current diff and returns a ready-to-use commit name.

2026-06-1713

security-check

bayesimpact/bayes-platform

Run Trivy vulnerability scan on Docker images (API, CPU workers, GPU workers). Builds images, scans for CRITICAL/HIGH CVEs, and reports findings.

2026-06-1013

name	trivy-ignore
description	Handle Trivy CVE findings by adding entries to .trivyignore.yaml when no upstream fix is available. Do NOT use npm overrides to work around transitive dependency CVEs — they break cross-platform lockfile entries (e.g. rollup native binaries).

When Trivy (or a CI security scan) reports CVEs in JS dependencies with no clear upstream fix, add them to .trivyignore.yaml with a short expiry.

Rules

Never use npm overrides to force-patch transitive dependency versions. Overrides cause npm install to regenerate the lockfile for the current platform only, dropping cross-platform optional native binaries (e.g. @rollup/rollup-linux-x64-gnu). This breaks CI/Vercel builds on Linux.
Prefer .trivyignore.yaml with a short expiry (30-60 days) for CVEs blocked on upstream package maintainers.
Only apply direct fixes (e.g. npm audit fix without --force) if they don't introduce breaking changes.

Steps

Read the current .trivyignore.yaml file at the repo root.
For each CVE to ignore, add an entry with:
- id: the CVE identifier (e.g. CVE-2026-33671)
- expired_at: 30-60 days from today (format: YYYY-MM-DD)
- reason: a short explanation — which package, why no fix is available, what's blocking upstream
Use the Edit tool to append the new entries under the vulnerabilities: key.
Verify the YAML is valid by checking indentation matches existing entries (2-space indent, dash-prefixed list items).

Example entry

  - id: CVE-2026-33671
    expired_at: 2026-06-01
    reason: "picomatch — no upstream fix available in transitive deps (jest, vite, angular-devkit)"