# Trivy configuration for the floxy project
# Docs: https://aquasecurity.github.io/trivy/latest/docs/configuration/config-file/

# What to scan in fs mode
scanners:
  - vuln     # vulnerabilities in OS packages and app libraries (go modules)
  - secret   # detect hard-coded secrets
  # You can add 'misconfig' later if you introduce IaC (Terraform/K8s/etc.)

# Only fail the build on meaningful issues
severity:
  - HIGH
  - CRITICAL

# Do not fail on issues that have no upstream fix yet
ignore-unfixed: true

# Non-zero exit when matching findings exist (keeps CI strict on high/critical)
exit-code: 1

# Reduce noise and speed up by skipping non-source folders and generated artifacts
skip-dirs:
  - docs
  - dev
  - examples

skip-files:
  - coverage.html
  - coverage.out

# Cache speeds up subsequent scans in CI (uses workspace cache if available)
cache:
  backend: fs

# Enable parallel scanning for faster CI times when supported
parallel: 4

# For Go projects, include both OS packages (if any) and application dependencies
vuln:
  type:
    - os
    - library