ci: scope rclone vulnerability exception

.trivyignore.yaml

@@ -41,6 +41,13 @@ vulnerabilities:
       - pkg:golang/stdlib@v1.26.5
     expired_at: 2026-11-20
     statement: The official rclone binary has no patched release for this embedded Go runtime yet.
+  - id: CVE-2026-56854
+    paths:
+      - usr/bin/rclone
+    purls:
+      - pkg:golang/golang.org/x/crypto@v0.54.0
+    expired_at: 2026-11-20
+    statement: The pinned stable rclone image has no release with the upstream x/crypto v0.55.0 fix yet; its SFTP callbacks do not set source-address permissions, so the affected path is not reachable. Reassess when this exception expires.
   - id: CVE-2026-56858
     paths:
       - usr/bin/rclone

docs/development-setup.md

@@ -182,6 +182,9 @@ uvx --from pip-audit pip-audit \
 
 导出文件由 `uv.lock` 生成且保留哈希，不作为项目依赖清单提交。
 
+Docker 镜像发布前还会使用 Trivy 扫描 OS 与语言包；根目录 `.trivyignore.yaml` 只允许记录按路径或 PURL
+限定、写明原因并设置到期时间的临时例外，修复或重新评估后应移除。
+
 ### 6. 提交代码前的检查
 
 在提交代码之前，请确保完成以下步骤：