feat: OPS-11677 Allow to skip files on trivy scan

[mcpovel]

As trivy scan will still complain on latest kubectl we will enable skipping files in scan to overcome these failing scans for specific stuff.

[Copilot]

Pull request overview

Adds workflow-call inputs to allow excluding specific directories/files from Trivy traversal (to work around known findings on bundled tools like kubectl) and wires those inputs through to the Trivy GitHub Action invocation.

Changes:

• Add skip_dirs / skip_files inputs to reusable workflows and pass them to Trivy (skip-dirs / skip-files).
• Update aquasecurity/trivy-action to a newer pinned revision.
• Update the caller workflow wiring to forward the new inputs.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/image-publish-trivy.yaml	Exposes skip inputs and forwards them into the Trivy reusable workflow call.
.github/workflows/check-trivy.yaml	Adds skip inputs, passes them to Trivy action, and updates pinned action revisions (but currently breaks SARIF upload step).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (4)

.github/workflows/image-publish-trivy.yaml:244

• The reusable workflow reference is pointing to a feature branch/ref (OPS-11677_CronToolsAuto) and includes a note to ignore it. This makes the workflow non-reproducible and will break once the branch is deleted. Please pin to the intended stable tag/ref before merging.

    uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-trivy.yaml@OPS-11677_CronToolsAuto # To be changed to @8 --- IGNORE ---

.github/workflows/image-publish-trivy.yaml:106

• Trailing whitespace in this default value is easy to miss and can cause noisy diffs or lint failures. Remove the extra spaces after the quoted empty string.

        description: 'comma separated list of directories where traversal is skipped'
        required: false
        default: ''        
        type: string

.github/workflows/image-publish-trivy.yaml:253

• This line has trailing whitespace at the end, which can create noisy diffs and may violate YAML/style checks. Remove the extra spaces after the expression.

      skip_dirs: ${{ inputs.skip_dirs }}
      skip_files: ${{ inputs.skip_files }}      

.github/workflows/check-trivy.yaml:48

• Trailing whitespace in this default value is easy to miss and can cause noisy diffs or lint failures. Remove the extra spaces after the quoted empty string.

        description: 'comma separated list of directories where traversal is skipped'
        required: false
        default: ''        
        type: string

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (5)

.github/workflows/image-publish-trivy.yaml:109

• Hyphenate “comma-separated” in the input description for consistency and correct grammar.

        description: 'comma separated list of files to be skipped'

.github/workflows/check-trivy.yaml:51

• Hyphenate “comma-separated” in the input description for consistency and correct grammar.

        description: 'comma separated list of files to be skipped'

.github/workflows/image-publish-trivy.yaml:244

• The reusable workflow is referenced via a feature branch ref. Branch refs can be deleted or rewritten, which makes this workflow non-reproducible and can break callers after merge. Prefer referencing the local workflow path (same revision) or a stable tag/commit SHA.

    uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-trivy.yaml@OPS-11677_CronToolsAuto # To be changed to @8 --- IGNORE ---

.github/workflows/image-publish-trivy.yaml:104

• Hyphenate “comma-separated” in the input description for consistency and correct grammar.

This issue also appears on line 109 of the same file.

        description: 'comma separated list of directories where traversal is skipped'

.github/workflows/check-trivy.yaml:46

• Hyphenate “comma-separated” in the input description for consistency and correct grammar.

This issue also appears on line 51 of the same file.

        description: 'comma separated list of directories where traversal is skipped'