scanignore.star¶

Manage scanner ignore files: .trivyignore, .semgrepignore and .gitleaksignore.

Each file holds one entry per line: a vulnerability ID for Trivy, a path pattern for Semgrep, a finding fingerprint for gitleaks. Comments (#) and blank lines are kept. Trivy entries can carry an expiry date (CVE-2024-1234 exp:2025-06-30), after which Trivy reports the finding again.

load("@fleet//scanignore.star", "entries", "add", "remove", "prune_expired")

Function	What it does
`entries`	Lists the entries in a scanner's ignore file.
`add`	Adds entries to a scanner's ignore file, creating it if needed.
`remove`	Removes entries from a scanner's ignore file.
`prune_expired`	Removes .trivyignore entries whose expiry date has passed.

entries¶

entries(repo, tool)

Lists the entries in a scanner's ignore file.

Arguments

Name	Description
`repo`	The repo passed to `change(repo)`.
`tool`	`trivy`, `semgrep` or `gitleaks`.

Returns: The entries in file order, without comments or Trivy expiry dates; empty when the file doesn't exist.

Example

entries(repo, "trivy")
# returns ["CVE-2024-1234", "GHSA-xxxx-yyyy-zzzz"]

Before

.trivyignore

# Not reachable: we never parse untrusted YAML.
CVE-2024-1234 exp:2025-06-30
GHSA-xxxx-yyyy-zzzz

Source

add¶

add(repo, tool, items, comment = None, expires = None)

Adds entries to a scanner's ignore file, creating it if needed.

Entries already in the file, with or without an expiry, are skipped. New entries go at the end, after a blank line and comment.

Arguments

Name	Description
`repo`	The repo passed to `change(repo)`.
`tool`	`trivy`, `semgrep` or `gitleaks`.
`items`	The entries to add: vulnerability IDs, path patterns or fingerprints.
`comment`	Why they're ignored, written as a `#` line above them.
`expires`	For Trivy, the date (`YYYY-MM-DD`) after which the entries stop being ignored.

Returns: The list of entries that were added.

Example

add(repo, "trivy", ["CVE-2024-1234", "CVE-2025-0001"], comment = "Fixed upstream in 1.4; waiting on the base image.", expires = "2026-12-31")
# returns ["CVE-2025-0001"]

BeforeAfter

.trivyignore

CVE-2024-1234

.trivyignore

CVE-2024-1234

# Fixed upstream in 1.4; waiting on the base image.
CVE-2025-0001 exp:2026-12-31

Source

remove¶

remove(repo, tool, items)

Removes entries from a scanner's ignore file.

A comment that only described removed entries goes with them.

Arguments

Name	Description
`repo`	The repo passed to `change(repo)`.
`tool`	`trivy`, `semgrep` or `gitleaks`.
`items`	The entries to remove.

Returns: The list of entries that were removed.

Example

remove(repo, "semgrep", ["gen/", "testdata/"])
# returns ["gen/", "testdata/"]

BeforeAfter

.semgrepignore

vendor/
# Generated by protoc.
gen/
testdata/

.semgrepignore

vendor/

Source

prune_expired¶

prune_expired(repo, today)

Removes .trivyignore entries whose expiry date has passed.

Trivy already stops honoring them, so this only tidies the file and shows which findings came back. Entries without an expiry stay.

Arguments

Name	Description
`repo`	The repo passed to `change(repo)`.
`today`	The current date as `YYYY-MM-DD`; entries expiring before it are removed.

Returns: The list of removed vulnerability IDs.

Example

prune_expired(repo, "2026-01-15")
# returns ["CVE-2024-1234"]

BeforeAfter

.trivyignore

# Waiting on the base image.
CVE-2024-1234 exp:2025-06-30
CVE-2025-0001 exp:2026-12-31
CVE-2023-9999

.trivyignore

# Waiting on the base image.
CVE-2025-0001 exp:2026-12-31
CVE-2023-9999

Used in: trivy-ignore-prune

Source