From 84cfe0d3392175a87334a54e238595e37e008302 Mon Sep 17 00:00:00 2001
From: Codex <codex@geointel.local>
Date: Sat, 18 Jul 2026 04:38:46 +0200
Subject: [PATCH] Fix container scan policy mount

---
 backend/tests/test_rc6_supply_chain.py | 2 ++
 scripts/scan_container_image.sh        | 4 +++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/backend/tests/test_rc6_supply_chain.py b/backend/tests/test_rc6_supply_chain.py
index 59cd987a..d67b739d 100644
--- a/backend/tests/test_rc6_supply_chain.py
+++ b/backend/tests/test_rc6_supply_chain.py
@@ -65,6 +65,8 @@ def test_scanner_images_are_versioned_and_digest_pinned() -> None:
     assert "--ignore-unfixed" in scan
     assert "--timeout 20m" in scan
     assert "--scanners vuln" in scan
+    assert '-v "$IGNORE_FILE:$CONTAINER_IGNORE_FILE:ro"' in scan
+    assert '--ignorefile "$CONTAINER_IGNORE_FILE"' in scan
     assert "geointel-container-vulnerabilities.json" in scan
 
 
diff --git a/scripts/scan_container_image.sh b/scripts/scan_container_image.sh
index 1db72d89..89771791 100644
--- a/scripts/scan_container_image.sh
+++ b/scripts/scan_container_image.sh
@@ -8,6 +8,7 @@ TRIVY_IMAGE="aquasec/trivy:0.70.0@sha256:be1190afcb28352bfddc4ddeb71470835d16462
 CACHE_DIR="${GEOINTEL_TRIVY_CACHE:-$ROOT/.cache/trivy}"
 PYTHON_CMD="${PYTHON_BIN:-python3}"
 IGNORE_FILE="$(mktemp)"
+CONTAINER_IGNORE_FILE="/tmp/geointel-trivy-ignore.txt"
 trap 'rm -f "$IGNORE_FILE"' EXIT
 
 case "$OUTPUT" in
@@ -42,13 +43,14 @@ docker run --rm \
 docker run --rm \
   -v /var/run/docker.sock:/var/run/docker.sock \
   -v "$CACHE_DIR:/root/.cache/trivy" \
+  -v "$IGNORE_FILE:$CONTAINER_IGNORE_FILE:ro" \
   "$TRIVY_IMAGE" \
   image \
   --scanners vuln \
   --timeout 20m \
   --skip-version-check \
   --ignore-unfixed \
-  --ignorefile "$IGNORE_FILE" \
+  --ignorefile "$CONTAINER_IGNORE_FILE" \
   --severity HIGH,CRITICAL \
   --exit-code 1 \
   "$TARGET_IMAGE"