From 50ac120123bdbab62938bc3c58abe90ee6754cf6 Mon Sep 17 00:00:00 2001
From: InfinityPacer <160988576+InfinityPacer@users.noreply.github.com>
Date: Sat, 22 Aug 2026 19:28:02 +0800
Subject: [PATCH] ci: time-bound vulnerability exceptions (#6396)

---
 .trivyignore.yaml                  | 10 ++++++++++
 tests/test_release_supply_chain.py | 14 ++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/.trivyignore.yaml b/.trivyignore.yaml
index 7f9c73026..e8614a70a 100644
--- a/.trivyignore.yaml
+++ b/.trivyignore.yaml
@@ -4,58 +4,68 @@ vulnerabilities:
       - Python
     purls:
       - pkg:pypi/msgpack@1.1.2
+    expired_at: 2026-11-20
     statement: The finding belongs to the base image's system pip and is not imported by MoviePilot.
   - id: CVE-2025-47273
     paths:
       - Python
     purls:
       - pkg:pypi/setuptools@70.3.0
+    expired_at: 2026-11-20
     statement: The finding belongs to the base image's system pip and is not used for dependency installation.
   - id: CVE-2026-33818
     paths:
       - usr/bin/rclone
     purls:
       - pkg:golang/stdlib@v1.26.5
+    expired_at: 2026-11-20
     statement: The official rclone binary has no patched release for this embedded Go runtime yet.
   - id: CVE-2026-39821
     paths:
       - usr/bin/rclone
     purls:
       - pkg:golang/stdlib@v1.26.5
+    expired_at: 2026-11-20
     statement: The official rclone binary has no patched release for this embedded Go runtime yet.
   - id: CVE-2026-46600
     paths:
       - usr/bin/rclone
     purls:
       - pkg:golang/stdlib@v1.26.5
+    expired_at: 2026-11-20
     statement: The official rclone binary has no patched release for this embedded Go runtime yet.
   - id: CVE-2026-56853
     paths:
       - usr/bin/rclone
     purls:
       - pkg:golang/stdlib@v1.26.5
+    expired_at: 2026-11-20
     statement: The official rclone binary has no patched release for this embedded Go runtime yet.
   - id: CVE-2026-56858
     paths:
       - usr/bin/rclone
     purls:
       - pkg:golang/stdlib@v1.26.5
+    expired_at: 2026-11-20
     statement: The official rclone binary has no patched release for this embedded Go runtime yet.
   - id: CVE-2026-56859
     paths:
       - usr/bin/rclone
     purls:
       - pkg:golang/stdlib@v1.26.5
+    expired_at: 2026-11-20
     statement: The official rclone binary has no patched release for this embedded Go runtime yet.
   - id: CVE-2026-56860
     paths:
       - usr/bin/rclone
     purls:
       - pkg:golang/stdlib@v1.26.5
+    expired_at: 2026-11-20
     statement: The official rclone binary has no patched release for this embedded Go runtime yet.
   - id: CVE-2026-56862
     paths:
       - usr/bin/rclone
     purls:
       - pkg:golang/stdlib@v1.26.5
+    expired_at: 2026-11-20
     statement: The official rclone binary has no patched release for this embedded Go runtime yet.
diff --git a/tests/test_release_supply_chain.py b/tests/test_release_supply_chain.py
index 06d3a540e..542794591 100644
--- a/tests/test_release_supply_chain.py
+++ b/tests/test_release_supply_chain.py
@@ -1,5 +1,6 @@
 """正式镜像发布的供应链门禁合同。"""
 
+from datetime import date
 from pathlib import Path
 
 from ruamel.yaml import YAML
@@ -8,6 +9,7 @@ from ruamel.yaml import YAML
 ROOT = Path(__file__).resolve().parents[1]
 DOCKERFILE = ROOT / "docker" / "Dockerfile"
 RELEASE_WORKFLOW = ROOT / ".github" / "workflows" / "build-v3.yml"
+TRIVY_IGNORE = ROOT / ".trivyignore.yaml"
 
 
 def _load_workflow() -> dict:
@@ -94,6 +96,18 @@ def test_release_scans_both_architectures_before_registry_login_and_publish() ->
     assert last_scan < names.index("Publish multi-architecture image")
 
 
+def test_vulnerability_ignores_are_scoped_justified_and_time_bounded() -> None:
+    """漏洞豁免必须限定制品范围，并保留复查期限和接受理由。"""
+    yaml = YAML(typ="safe")
+    vulnerabilities = yaml.load(TRIVY_IGNORE.read_text(encoding="utf-8"))["vulnerabilities"]
+
+    for vulnerability in vulnerabilities:
+        assert vulnerability["paths"]
+        assert vulnerability["purls"]
+        assert vulnerability["statement"]
+        assert isinstance(vulnerability["expired_at"], date)
+
+
 def test_publish_reuses_scanned_architecture_caches_without_refreshing_base() -> None:
     """发布构建复用已扫描候选缓存，不得在扫描后重新拉取未审计基础镜像。"""
     workflow = _load_workflow()