From e501ab145f9373e48044812cdec117b6966b40ce Mon Sep 17 00:00:00 2001
From: peet <peet@noctrl.eu>
Date: Sun, 30 Aug 2026 10:26:35 +0200
Subject: [PATCH] trivy-scan: optional skip-dirs input for vendored toolchains
 (#4)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For directories whose bundled dependencies cannot be upgraded in place —
first user: the Android SDK cmdline-tools jars (old protobuf/guava et al.
inside sdkmanager) in the gitea-runner-android image. Callers must leave a
comment in the workflow explaining each exclusion.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
Reviewed-on: https://gitea.noctrl.eu/public/actions/pulls/4
Co-authored-by: peet <peet@noctrl.eu>
---
 trivy-scan/action.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/trivy-scan/action.yaml b/trivy-scan/action.yaml
index 99b60b1..adc826f 100644
--- a/trivy-scan/action.yaml
+++ b/trivy-scan/action.yaml
@@ -17,6 +17,14 @@ inputs:
     description: Comma-separated Trivy severities that fail the scan.
     required: false
     default: HIGH,CRITICAL
+  skip-dirs:
+    description: >
+      Comma-separated directories inside the image to exclude from the scan.
+      For vendored third-party toolchains whose bundled dependencies cannot
+      be upgraded in place (e.g. the Android SDK's cmdline-tools jars) —
+      always leave a comment in the workflow explaining why.
+    required: false
+    default: ""
   registry-username:
     description: Registry username for pulling the image.
     required: true
@@ -42,6 +50,12 @@ runs:
 
         image_ref="registry.noctrl.eu/${{ inputs.image-name }}:${{ inputs.tag }}"
 
+        extra_args=()
+        if [[ -n "${{ inputs.skip-dirs }}" ]]; then
+          extra_args+=(--skip-dirs "${{ inputs.skip-dirs }}")
+          echo "Excluding from scan: ${{ inputs.skip-dirs }}"
+        fi
+
         # --ignore-unfixed: unfixed base-image CVEs are unactionable and would
         # perma-block builds; the gate is on vulnerabilities with a fix.
         echo "Scanning ${image_ref} (fail on: ${{ inputs.severity }}, fixed only)"
@@ -51,4 +65,5 @@ runs:
           --ignore-unfixed \
           --exit-code 1 \
           --no-progress \
+          "${extra_args[@]}" \
           "${image_ref}"