Scan configuration
Configure image and infrastructure scans and document narrowly scoped exceptions
Esta página aún no está disponible en tu idioma.
grype.yaml defines the shared Grype scan configuration.
deploy/pipeline/scripts/scan-image.sh makes image and SBOM scans fail on High and Critical findings.
Add an entry to its ignore list only for a reviewed finding that is not exploitable in the shipped artifact or has no available upstream fix.
Each exception entry must include the vulnerability id, affected package, justification, and review date. Keep exceptions narrow enough that an upgraded package or a different image must be reviewed again.
checkov.yaml scopes infrastructure checks to release Dockerfiles, pipeline configuration, and GitLab CI configuration.
Checkov suppressions belong next to the affected resource with a short current-state reason.