Fix container scan policy mount

backend/tests/test_rc6_supply_chain.py

@@ -65,6 +65,8 @@ def test_scanner_images_are_versioned_and_digest_pinned() -> None:
     assert "--ignore-unfixed" in scan
     assert "--timeout 20m" in scan
     assert "--scanners vuln" in scan
+    assert '-v "$IGNORE_FILE:$CONTAINER_IGNORE_FILE:ro"' in scan
+    assert '--ignorefile "$CONTAINER_IGNORE_FILE"' in scan
     assert "geointel-container-vulnerabilities.json" in scan
 
 

scripts/scan_container_image.sh

@@ -8,6 +8,7 @@ TRIVY_IMAGE="aquasec/trivy:0.70.0@sha256:be1190afcb28352bfddc4ddeb71470835d16462
 CACHE_DIR="${GEOINTEL_TRIVY_CACHE:-$ROOT/.cache/trivy}"
 PYTHON_CMD="${PYTHON_BIN:-python3}"
 IGNORE_FILE="$(mktemp)"
+CONTAINER_IGNORE_FILE="/tmp/geointel-trivy-ignore.txt"
 trap 'rm -f "$IGNORE_FILE"' EXIT
 
 case "$OUTPUT" in
@@ -42,13 +43,14 @@ docker run --rm \
 docker run --rm \
   -v /var/run/docker.sock:/var/run/docker.sock \
   -v "$CACHE_DIR:/root/.cache/trivy" \
+  -v "$IGNORE_FILE:$CONTAINER_IGNORE_FILE:ro" \
   "$TRIVY_IMAGE" \
   image \
   --scanners vuln \
   --timeout 20m \
   --skip-version-check \
   --ignore-unfixed \
-  --ignorefile "$IGNORE_FILE" \
+  --ignorefile "$CONTAINER_IGNORE_FILE" \
   --severity HIGH,CRITICAL \
   --exit-code 1 \
   "$TARGET_IMAGE"