# Structured Trivy suppression baseline.
#
# This repository-root file is the only CI suppression source. Every Trivy invocation must name it
# with `--ignorefile .trivyignore.yaml`; ad-hoc ignore files and inline bypasses are not allowed.
#
# Every entry must carry:
#   id:         advisory, license, misconfiguration, or secret identifier
#   statement:  non-empty accepted-risk or false-positive rationale
#   expired_at: future YYYY-MM-DD, no more than 90 days from review
#
# Enforced by review, not by a build task. `verifyTrivyignore` used to be a 105-line hand-written
# YAML parser in the root build — indentation tracking, inline-scalar handling, quote stripping — and
# what it guarded was this file, which has been empty since it was created. A suppression is added by
# a human and merged by a CODEOWNERS reviewer (.github/dependency-vulnerability-policy.md); that
# reviewer is the control, and a parser that has never seen an entry is not a second one.
#
# If this file ever carries entries and they start drifting, that is the moment to automate the
# check — against real entries, with a real YAML library. Not before.

vulnerabilities: []
licenses: []
misconfigurations: []
secrets: []