# Structured Trivy suppression baseline.
#
# This repository-root file is the only CI suppression source. Every future entry must include:
#   id: advisory, license, misconfiguration, or secret identifier
#   statement: non-empty accepted-risk or false-positive rationale
#   expired_at: future YYYY-MM-DD no more than 90 days from review
#
# `verifyTrivyignore` enforces those fields and the expiry window. CODEOWNERS supplies the separate
# reviewer control. Every Trivy invocation must also name this file with
# `--ignorefile .trivyignore.yaml`; do not add ad-hoc ignore files or inline bypasses.

vulnerabilities: []
licenses: []
misconfigurations: []
secrets: []