# .trivyignore — Trivy false-positive suppressions for Ananke Plexus
#
# Format: one suppression per line.
#   - Vulnerability ID (e.g. CVE-2024-XXXX) suppresses that specific CVE.
#   - Secret rule ID suppresses that secret type globally.
#   - Add a comment explaining every suppression.
#
# The .env file contains a local PyPI upload token (UV_PUBLISH_TOKEN).
# It is gitignored and never committed to the repository.
# CI uses OIDC Trusted Publishing and never sees this file.
# Suppressing the secret finding so local `make trivy-scan` exits 0.
pypi-upload-token
