fix(ci): suppress Trivy go-git vulnerability temporarily (#12405)

.github/workflows/api-container-checks.yml

@@ -111,6 +111,7 @@ jobs:
         with:
           files: |
             api/**
+            .trivyignore.yaml
             .github/actions/trivy-scan/**
             .github/actions/grype-scan/**
             .grype.yaml

.github/workflows/mcp-container-checks.yml

@@ -103,6 +103,7 @@ jobs:
         with:
           files: |
             mcp_server/**
+            .trivyignore.yaml
             .github/actions/trivy-scan/**
             .github/actions/grype-scan/**
             .grype.yaml

.github/workflows/sdk-container-checks.yml

@@ -10,6 +10,7 @@ on:
       - 'Dockerfile*'
       - 'pyproject.toml'
       - 'uv.lock'
+      - '.trivyignore.yaml'
       - '.github/workflows/sdk-container-checks.yml'
   pull_request:
     branches:
@@ -116,6 +117,7 @@ jobs:
             Dockerfile*
             pyproject.toml
             uv.lock
+            .trivyignore.yaml
             .github/workflows/sdk-container-checks.yml
             .github/actions/trivy-scan/**
             .github/actions/grype-scan/**

.github/workflows/ui-container-checks.yml

@@ -104,6 +104,7 @@ jobs:
         with:
           files: |
             ui/**
+            .trivyignore.yaml
             .github/actions/trivy-scan/**
             .github/actions/grype-scan/**
             .grype.yaml

.grype.yaml

@@ -9,6 +9,14 @@ ignore:
 
   # Modules compiled into the Trivy binary we ship.
   # Only a Trivy rebuild by its vendor can change these; the version is pinned in our Dockerfile.
+  # CVE-2026-71556 is the same temporary exception documented in .trivyignore.yaml:
+  # Trivy 0.73.0 still embeds go-git 5.19.1, while the 5.19.2 fix is merged only on
+  # Trivy main. Remove this entry with the Trivy exception by 2026-09-15.
+  # https://github.com/aquasecurity/trivy/blob/v0.73.0/go.mod#L46
+  # https://github.com/aquasecurity/trivy/commit/a2edba9a03987ba0d2ebc8212c1a9a1e6979497b
+  - vulnerability: CVE-2026-71556
+    package:
+      name: github.com/go-git/go-git/v5
   - vulnerability: CVE-2026-56852
     package:
       name: golang.org/x/text

.trivyignore.yaml

@@ -120,6 +120,20 @@ vulnerabilities:
 
   # Modules compiled into the Trivy binary the images ship. The binary is pinned by version
   # and verified by checksum in the Dockerfile; only a rebuild by its vendor moves these.
+  # CVE-2026-71556 affects go-git worktree operations that can follow symlinks outside a
+  # cloned repository. Trivy 0.72.0 contains go-git 5.19.1, and even the latest published
+  # Trivy release, 0.73.0, still pins that vulnerable version:
+  # https://github.com/aquasecurity/trivy/blob/v0.73.0/go.mod#L46
+  # Trivy main already contains the 5.19.2 fix, but no published release includes it yet:
+  # https://github.com/aquasecurity/trivy/commit/a2edba9a03987ba0d2ebc8212c1a9a1e6979497b
+  # Prowler invokes Trivy only with `fs` on an existing local path or with `image`; it does
+  # not ask Trivy to clone or mutate a Git worktree, so the affected path is not reachable.
+  # Remove this temporary suppression as soon as a fixed Trivy release is available.
+  - id: CVE-2026-71556
+    purls:
+      - "pkg:golang/github.com/go-git/go-git/v5"
+    expired_at: 2026-09-15
+
   - id: CVE-2026-56852
     purls:
       - "pkg:golang/golang.org/x/text"
@@ -140,4 +154,3 @@ vulnerabilities:
     purls:
       - "pkg:golang/stdlib"
     expired_at: 2026-12-31
-