ci(security): only fail Docker Scout on fixable CVEs

Add only-fixed so the scan no longer fails on vulnerabilities with no upstream fix available (e.g. base-image OS packages), and only flags actionable, fixable findings.
2026-06-19 21:31:46 +00:00 · 2026-06-15 10:21:39 +02:00
parent 127a92c8f5
commit 8d1e7dded0
1 changed files with 1 additions and 0 deletions
@@ -34,4 +34,5 @@ jobs:
          command: cves
          image: trek:scan
          only-severities: critical,high
+          only-fixed: true
          exit-code: true