ci(repo): suppress pip-vendored CVE findings in orb-agent image scans

[unlisted]

Summary

• Added a root .trivyignore.yaml covering three findings that come from pip's vendored packages under pip/_vendor/, not from any orb-agent dependency: GHSA-6v7p-g79w-8964 (msgpack 1.1.2, HIGH), CVE-2025-47273 (setuptools 70.3.0, HIGH), CVE-2026-59890 (setuptools 70.3.0, MEDIUM). These are what currently block Build & Scan on the release PR release #521.
• Wired the ignore file into build.yaml, and into container-rescan.yaml, which also needed an actions/checkout: it only pulled the image, so a repo-root ignore file could never have applied there.
• Added a comment at the pip pin in agent/docker/Dockerfile: the ignore entries are pinned by exact PURL, so moving that pin makes them stop matching and the scan fail until they are re-verified.

The diff is additive only. No existing step or script is modified.

Why suppress rather than fix

pip 26.2.1 is the latest release and vendors exactly these versions, so there is no upgrade path, and the image needs pip at runtime for the entrypoint's INSTALL_DRIVERS_PATH / INSTALL_WORKERS_PATH feature.

• setuptools (both CVEs): pip vendors only the pkg_resources shim. There is no pip/_vendor/setuptools/ directory and no package_index.py anywhere under _vendor/. The vulnerable code is absent from the image.
• msgpack: the out-of-bounds read requires reusing an Unpacker after a caught exception. pip's only msgpack consumer is vendored CacheControl, which unpacks HTTP-cache entries it serialized itself, with a fresh unpack per read.

Each entry carries a statement and expired_at: 2026-11-08, so the suppression cannot silently become permanent. Entries are pinned by PURL rather than bare ID so they cannot quietly cover a future, genuinely-reachable copy of the same package.

What triggered this

No code change here caused it. python:3.14-alpine refreshed its bundled pip to 26.2.x, and pip 26.2 is the first release to ship an embedded CycloneDX SBOM at pip/_vendor/bom.cdx.json (absent in 25.3/26.0/26.1/26.1.2, present in 26.2/26.2.1). Vendored packages carry no dist-info metadata, so Trivy had no way to see them before that file existed. The vendored versions themselves have not changed since at least pip 25.3, and all three advisories were published well before the alerts appeared on 2026-08-05.

Test plan

• Scanned the published netboxlabs/orb-agent:develop image with Trivy 0.70.0 (the version this action installs): 3 findings before, 0 after.
• Ran the existing build.yaml summary script under node against that scan output: has_blocking = false.
• Backdated expired_at and re-scanned: all three findings return, so the expiry is live rather than decorative.
• Replayed trivy-action's entrypoint.sh at the pinned SHA with a stub trivy on PATH: resolves to TRIVY_IGNOREFILE=.trivyignore.yaml.
• trivy convert from the suppressed report yields 0 SARIF results and 0 SBOM vulnerabilities, so the three open code-scanning alerts should close on the first develop analysis after merge.

[leoparente]

@unlisted this is required? Current issues does not block merge PRS

[Copilot]

Pull request overview

Adds a repository-level Trivy ignore policy for pip-vendored SBOM findings and wires it into the CI image scanning workflows, so orb-agent image scans stop failing on unreachable vendored-package advisories while enforcing an expiry-based revalidation.

Changes:

• Added a root .trivyignore.yaml with three PURL-pinned, expiring suppressions for pip _vendor findings.
• Updated the Trivy scan steps in build.yaml and container-rescan.yaml to explicitly use .trivyignore.yaml.
• Added a checkout step to container-rescan.yaml so the ignore file is available when scanning a published image.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
agent/docker/Dockerfile	Adds a note tying the pip pin to the Trivy suppression rules.
.trivyignore.yaml	Introduces expiring, PURL-scoped Trivy vulnerability suppressions for pip-vendored packages.
.github/workflows/container-rescan.yaml	Checks out the repo and passes .trivyignore.yaml to Trivy during scheduled rescans.
.github/workflows/build.yaml	Passes .trivyignore.yaml to Trivy during build-time image scanning.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[unlisted]

@unlisted this is required? Current issues does not block merge PRS

Oh shoot. I misread the failed check as a blocker. No, it's not required. Maybe consider merging this or removing the check altogether because it is confusing. I will merge the release PR.

[github-actions]

Vulnerability Scan: Passed

Image: orb-agent:scan

No vulnerabilities found.

Commit: 67f848a