From 2b831fc50be5c22054b4ad15082a3fe0e63ff192 Mon Sep 17 00:00:00 2001
From: libops-agent <115990865+libops-agent@users.noreply.github.com>
Date: Wed, 2 Sep 2026 09:49:54 +0000
Subject: [PATCH] [patch] Remove Trivy image scanning

---
 .github/workflows/build-push.yml | 11 -----------
 .trivyignore                     |  4 ----
 ci/workflow_contract_test.go     | 20 --------------------
 3 files changed, 35 deletions(-)
 delete mode 100644 .trivyignore

diff --git a/.github/workflows/build-push.yml b/.github/workflows/build-push.yml
index 6b5233d..72d712e 100644
--- a/.github/workflows/build-push.yml
+++ b/.github/workflows/build-push.yml
@@ -84,16 +84,6 @@ jobs:
           push: false
           tags: cap:ci-${{ matrix.architecture.suffix }}
 
-      - name: Scan native image
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        with:
-          image-ref: cap:ci-${{ matrix.architecture.suffix }}
-          format: table
-          exit-code: "1"
-          ignore-unfixed: true
-          severity: HIGH,CRITICAL
-          vuln-type: os,library
-
   run:
     name: run
     if: ${{ always() && github.event_name == 'pull_request' }}
@@ -110,7 +100,6 @@ jobs:
     with:
       ref: ${{ github.sha }}
       expected-main-sha: ${{ github.ref == 'refs/heads/main' && github.sha || '' }}
-      scan: true
       sign: true
       certificate-identity: https://github.com/libops/.github/.github/workflows/build-push.yaml@a86300fb8020d0f7141bb9f833d89b5dbd7aa4d7
     permissions:
diff --git a/.trivyignore b/.trivyignore
deleted file mode 100644
index 5aa8523..0000000
--- a/.trivyignore
+++ /dev/null
@@ -1,4 +0,0 @@
-# Cap links the Prometheus parser/export client, not Prometheus's remote-read
-# HTTP handler where this decompression issue exists. Remove this exception
-# when prometheus-engine exposes a supported exporter on the patched line.
-CVE-2026-42154 exp:2026-10-01
diff --git a/ci/workflow_contract_test.go b/ci/workflow_contract_test.go
index a3c3fdc..8b4601a 100644
--- a/ci/workflow_contract_test.go
+++ b/ci/workflow_contract_test.go
@@ -23,7 +23,6 @@ func TestImagePublicationWorkflowContract(t *testing.T) {
 		"libops/.github/.github/workflows/build-push.yaml@" + sharedPublisherSHA,
 		"ref: ${{ github.sha }}",
 		"expected-main-sha: ${{ github.ref == 'refs/heads/main' && github.sha || '' }}",
-		"scan: true",
 		"sign: true",
 		"certificate-identity: https://github.com/libops/.github/.github/workflows/build-push.yaml@" + sharedPublisherSHA,
 		"packages: write",
@@ -48,22 +47,3 @@ func TestImagePublicationWorkflowContract(t *testing.T) {
 		}
 	}
 }
-
-func TestTrivyExceptionIsNarrowAndExpiring(t *testing.T) {
-	ignore, err := os.ReadFile("../.trivyignore")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	lines := strings.Split(strings.TrimSpace(string(ignore)), "\n")
-	var rules []string
-	for _, line := range lines {
-		line = strings.TrimSpace(line)
-		if line != "" && !strings.HasPrefix(line, "#") {
-			rules = append(rules, line)
-		}
-	}
-	if len(rules) != 1 || rules[0] != "CVE-2026-42154 exp:2026-10-01" {
-		t.Fatalf("unexpected Trivy exception rules: %q", rules)
-	}
-}