From 748c4c6c138af83fbdc5436b9e5c5fd2804d5e0f Mon Sep 17 00:00:00 2001
From: Alexey Shalaev <75322386+AlexeyShalaev@users.noreply.github.com>
Date: Tue, 27 Oct 2026 19:48:01 +0400
Subject: [PATCH] ci: ignore CVE-2026-84782 until distroless ships the libssl3
 fix

---
 .trivyignore | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 .trivyignore

diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 0000000..8aa899d
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1,5 @@
+# libssl3 3.0.20-1~deb12u2 comes from gcr.io/distroless/cc-debian12:nonroot, which has not
+# been rebuilt with Debian's fix (3.0.22-1~deb12u2) yet. Nothing in this image can patch it:
+# distroless has no package manager. Remove this line once the base image ships the fix;
+# the expiry makes the scan fail again on its own if it is forgotten.
+CVE-2026-84782 exp:2026-11-10