trivy-ignore

Étoiles13

Forks2

Mis à jour31 mars 2026 à 08:40

Handle Trivy CVE findings by adding entries to .trivyignore.yaml when no upstream fix is available. Do NOT use npm overrides to work around transitive dependency CVEs — they break cross-platform lockfile entries (e.g. rollup native binaries).

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Source

bayesimpact

bayesimpact/bayes-platform

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Métiers associésSOC

Basé sur la classification professionnelle SOC

Développeurs de logicielsProfessions informatiques et mathématiques·SOC 15-1252

SKILL.md

readonly

name	trivy-ignore
description	Handle Trivy CVE findings by adding entries to .trivyignore.yaml when no upstream fix is available. Do NOT use npm overrides to work around transitive dependency CVEs — they break cross-platform lockfile entries (e.g. rollup native binaries).

When Trivy (or a CI security scan) reports CVEs in JS dependencies with no clear upstream fix, add them to .trivyignore.yaml with a short expiry.

Rules

Never use npm overrides to force-patch transitive dependency versions. Overrides cause npm install to regenerate the lockfile for the current platform only, dropping cross-platform optional native binaries (e.g. @rollup/rollup-linux-x64-gnu). This breaks CI/Vercel builds on Linux.
Prefer .trivyignore.yaml with a short expiry (30-60 days) for CVEs blocked on upstream package maintainers.
Only apply direct fixes (e.g. npm audit fix without --force) if they don't introduce breaking changes.

Steps

Read the current .trivyignore.yaml file at the repo root.
For each CVE to ignore, add an entry with:
- id: the CVE identifier (e.g. CVE-2026-33671)
- expired_at: 30-60 days from today (format: YYYY-MM-DD)
- reason: a short explanation — which package, why no fix is available, what's blocking upstream
Use the Edit tool to append the new entries under the vulnerabilities: key.
Verify the YAML is valid by checking indentation matches existing entries (2-space indent, dash-prefixed list items).

Example entry

  - id: CVE-2026-33671
    expired_at: 2026-06-01
    reason: "picomatch — no upstream fix available in transitive deps (jest, vite, angular-devkit)"

Plus depuis ce dépôt

même dépôt

check-permission-matrix

bayesimpact/bayes-platform

Audit that docs/rbac-permission-matrix.md matches the RBAC catalog in code (roles, permissions, and grants in rbac.constants.ts and api-contracts permissions.ts). Reports every mismatch.

2026-07-3113

crud-generator

bayesimpact/bayes-platform

Generate CRUD boilerplate (backend NestJS controller/service/module/guard/policy/factory/routes/e2e + frontend Redux slice/thunks/selectors/middleware/spi/api) from a given entity file and a list of methods.

2026-07-2813

end-feature

bayesimpact/bayes-platform

Run the last steps before ending a feature. Shows a form where you can check/uncheck which final steps to run — update changelog, create a branch, run tests-parallel, create a PR — then executes the selected steps in that order.

2026-07-0913

new-issue

bayesimpact/bayes-platform

Create a GitHub issue on bayesimpact/bayes-platform from a free-text description. Drafts a clear title and structured body, picks appropriate labels, and posts it via the gh CLI, returning the issue URL. Optionally enriches the issue with context from the current codebase.

2026-07-0813

commit-name

bayesimpact/bayes-platform

Suggest a Conventional Commits message for the last changes without committing. Analyzes the current diff and returns a ready-to-use commit name.

2026-06-1713

security-check

bayesimpact/bayes-platform

Run Trivy vulnerability scan on Docker images (API, CPU workers, GPU workers). Builds images, scans for CRITICAL/HIGH CVEs, and reports findings.

2026-06-1013

name	trivy-ignore
description	Handle Trivy CVE findings by adding entries to .trivyignore.yaml when no upstream fix is available. Do NOT use npm overrides to work around transitive dependency CVEs — they break cross-platform lockfile entries (e.g. rollup native binaries).

When Trivy (or a CI security scan) reports CVEs in JS dependencies with no clear upstream fix, add them to .trivyignore.yaml with a short expiry.

Rules

Never use npm overrides to force-patch transitive dependency versions. Overrides cause npm install to regenerate the lockfile for the current platform only, dropping cross-platform optional native binaries (e.g. @rollup/rollup-linux-x64-gnu). This breaks CI/Vercel builds on Linux.
Prefer .trivyignore.yaml with a short expiry (30-60 days) for CVEs blocked on upstream package maintainers.
Only apply direct fixes (e.g. npm audit fix without --force) if they don't introduce breaking changes.

Steps

Read the current .trivyignore.yaml file at the repo root.
For each CVE to ignore, add an entry with:
- id: the CVE identifier (e.g. CVE-2026-33671)
- expired_at: 30-60 days from today (format: YYYY-MM-DD)
- reason: a short explanation — which package, why no fix is available, what's blocking upstream
Use the Edit tool to append the new entries under the vulnerabilities: key.
Verify the YAML is valid by checking indentation matches existing entries (2-space indent, dash-prefixed list items).

Example entry

  - id: CVE-2026-33671
    expired_at: 2026-06-01
    reason: "picomatch — no upstream fix available in transitive deps (jest, vite, angular-devkit)"