trivy-scan: optional skip-dirs input for vendored toolchains

For directories whose bundled dependencies cannot be upgraded in place —
first user: the Android SDK cmdline-tools jars (old protobuf/guava et al.
inside sdkmanager) in the gitea-runner-android image. Callers must leave a
comment in the workflow explaining each exclusion.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg

trivy-scan/action.yaml

@@ -17,6 +17,14 @@ inputs:
     description: Comma-separated Trivy severities that fail the scan.
     required: false
     default: HIGH,CRITICAL
+  skip-dirs:
+    description: >
+      Comma-separated directories inside the image to exclude from the scan.
+      For vendored third-party toolchains whose bundled dependencies cannot
+      be upgraded in place (e.g. the Android SDK's cmdline-tools jars) —
+      always leave a comment in the workflow explaining why.
+    required: false
+    default: ""
   registry-username:
     description: Registry username for pulling the image.
     required: true
@@ -42,6 +50,12 @@ runs:
 
         image_ref="registry.noctrl.eu/${{ inputs.image-name }}:${{ inputs.tag }}"
 
+        extra_args=()
+        if [[ -n "${{ inputs.skip-dirs }}" ]]; then
+          extra_args+=(--skip-dirs "${{ inputs.skip-dirs }}")
+          echo "Excluding from scan: ${{ inputs.skip-dirs }}"
+        fi
+
         # --ignore-unfixed: unfixed base-image CVEs are unactionable and would
         # perma-block builds; the gate is on vulnerabilities with a fix.
         echo "Scanning ${image_ref} (fail on: ${{ inputs.severity }}, fixed only)"
@@ -51,4 +65,5 @@ runs:
           --ignore-unfixed \
           --exit-code 1 \
           --no-progress \
+          "${extra_args[@]}" \
           "${image_ref}"