Repository navigation
Skip trivy KSV-0039: 450 of 614 findings are a per-file artifact hiding 29 HIGH/CRITICAL #2988
Description
🤖 Generated by the Agentic Engineer
Evidence: trivy fails 614 misconfiguration checks on this tree, and 450 of them (73%) are
a single LOW check — KSV-0039 "limit range usage" (measured at 005761c0; full breakdown on
#2787). It is a per-file artifact, not a gap. The file kinds it fires on are objects that cannot
carry a LimitRange:
46 helm-release.yaml 46 cilium-network-policy.yaml 42 helm-repository.yaml
23 pod-disruption-budget.yaml 14 http-route.yaml 13 external-secret.yaml
8 network-policy.yaml 6 flux-kustomization.yaml
The decisive control: it also fires on the manifests that define LimitRanges —
k8s/bases/infrastructure/limit-ranges/kube-system.yaml, .../kyverno.yaml, and
k8s/providers/hetzner/infrastructure/controllers/longhorn/limit-range.yaml. A check that reports
"limit range usage" against a LimitRange is reading file contents, not namespace state, and this
repository keeps its LimitRanges in a dedicated base by design. No per-file edit can satisfy it,
which is exactly the "genuinely irreducible" case #2787 reserves a scoped, justified skip for.
Audience/problem: the 450 are not merely noise — they hide the real signal. The residual 164
contains 29 HIGH/CRITICAL findings (RBAC breadth: KSV-0114 webhookconfigurations ×5, KSV-0046
manage-all-resources ×5, KSV-0041 manage-secrets ×4, KSV-0056 networking ×8), and today those sit
behind an undifferentiated count of 614 that nobody can triage at a glance. Suppressing the artifact
is what makes the rest readable.
Expected behaviour: KSV-0039 is skipped repo-wide via a .trivyignore carrying its reason, and
trivy's count drops to the findings that describe real state.
Proved already (mechanism + ablation, at 005761c0):
| state | trivy FAIL total |
|---|---|
with .trivyignore |
164 |
| ablated (file removed, same command) | 614 |
| KSV-0039 remaining, with the file | 0 |
164 = 614 − 450 exactly, so nothing beyond KSV-0039 is suppressed — over-suppression would put the
total below 164.
Acceptance criteria:
-
.trivyignoreskips KSV-0039 and states why, in the repo's own convention (reason recorded,
never a bare id). - Trivy's reported count on
maindrops 614 → 164, verified by
scripts/megalinter-scan-counts.sh, not by a CI summary line. - No other check id is suppressed — the residual per-id breakdown is unchanged apart from
KSV-0039 going to 0. - The counts recorded in
.mega-linter.yml'sDISABLE_ERRORS_LINTERSblock are updated to the
new measurement, per that block's own rule that every figure there is a measurement.
Does not remove REPOSITORY_TRIVY from DISABLE_ERRORS_LINTERS — 164 findings remain and #2787
owns that removal.
Rough size: S. Part of #2787
Activity
coderabbitai commentedon Aug 6, 2026
🔗 Related PRs
#2852 - chore(lint): reproduce MegaLinter's checkov and trivy counts outside CI [merged]
#2876 - feat(security): derive themed, deduped backlog entries from live Kubescape findings [merged]
#2893 - security(k8s): disposition CKV_SECRET_6 as key references, not secret material [merged]
#2900 - security(k8s): withdraw the CKV_K8S_40 suppressions whose reasons do not hold [merged]
#2911 - fix(security): disposition the three unconstrained CKV_K8S_40 sites [merged]
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:💬 Have feedback or questions? Drop into our discord!