DevOps-Security-Agent-Skills/security/scanning/vulnerability-scanning/assets/trivy-config.yaml

# Trivy Configuration
# Place in project root or ~/.trivy.yaml

# Scan settings
scan:
  # Scanners to use
  scanners:
    - vuln
    - secret
    - config
  
  # Severity levels to report
  severity:
    - CRITICAL
    - HIGH
    - MEDIUM

# Vulnerability settings  
vulnerability:
  # Ignore unfixed vulnerabilities
  ignore-unfixed: true
  
  # Vulnerability types
  type:
    - os
    - library

# Secret scanning settings
secret:
  config: trivy-secret.yaml

# Misconfiguration settings
misconfiguration:
  # Policy paths (custom OPA policies)
  policy:
    - ./policies

# Cache settings
cache:
  # Cache directory
  dir: /tmp/trivy-cache
  
  # Cache TTL in hours
  ttl: 24h

# Database settings
db:
  # Repository for vulnerability database
  repository: ghcr.io/aquasecurity/trivy-db

# Output settings
format: table
output: ""

# Exit code when vulnerabilities found
exit-code: 0

# Ignore specific files
skip-files:
  - "**/*_test.go"
  - "**/test/**"

# Ignore specific directories
skip-dirs:
  - node_modules
  - vendor
  - .git

# Custom ignore file
ignorefile: .trivyignore.yaml