fix(release): make deployment backup and rollback immutable

scripts/scan_container_image.sh

@@ -21,8 +21,17 @@ esac
 docker image inspect "$TARGET_IMAGE" >/dev/null
 mkdir -p "$ROOT/$(dirname "$OUTPUT")" "$CACHE_DIR"
 "$PYTHON_CMD" "$ROOT/scripts/verify_security_exceptions.py"
-"$PYTHON_CMD" "$ROOT/scripts/verify_security_exceptions.py" \
-  --print-container-ids > "$IGNORE_FILE"
+mapfile -t ignored_container_ids < <(
+  "$PYTHON_CMD" "$ROOT/scripts/verify_security_exceptions.py" \
+    --print-container-ids | tr -d '\r'
+)
+ignore_args=()
+trivy_ignore_args=()
+if [ "${#ignored_container_ids[@]}" -gt 0 ]; then
+  printf '%s\n' "${ignored_container_ids[@]}" > "$IGNORE_FILE"
+  ignore_args=(-v "$IGNORE_FILE:$CONTAINER_IGNORE_FILE:ro")
+  trivy_ignore_args=(--ignorefile "$CONTAINER_IGNORE_FILE")
+fi
 
 # Keep the complete report, including vulnerabilities without an available fix.
 docker run --rm \
@@ -45,14 +54,14 @@ docker run --rm \
 docker run --rm \
   -v /var/run/docker.sock:/var/run/docker.sock \
   -v "$CACHE_DIR:/root/.cache/trivy" \
-  -v "$IGNORE_FILE:$CONTAINER_IGNORE_FILE:ro" \
+  "${ignore_args[@]}" \
   "$TRIVY_IMAGE" \
   image \
   --scanners vuln \
   --timeout 20m \
   --skip-version-check \
   --ignore-unfixed \
-  --ignorefile "$CONTAINER_IGNORE_FILE" \
+  "${trivy_ignore_args[@]}" \
   --skip-files /usr/local/bin/gosu \
   --severity HIGH,CRITICAL \
   --exit-code 1 \