From 669b87c025eef3b38ee971c0fd816fbe6ac07cdd Mon Sep 17 00:00:00 2001
From: Agustin Celentano <12614595+agustincelentano@users.noreply.github.com>
Date: Mon, 14 Sep 2026 16:42:14 -0300
Subject: [PATCH] ci: suppress AVD-DS-0002 for the worker images

The Trivy IaC gate fails on both Dockerfiles added in #9 with DS-0002 ("Image
user should not be 'root'"). They build on the shared worker-bridge base, which
runs as root by design today; the runtime user comes from the agent's worker pod
securityContext and patches, not from a USER directive in these files.

services-postgresql-rds carries the same suppression with the same rationale for
the same two images. Copying the Dockerfiles from that repository without its
.trivyignore entry is what left the gate red.
---
 .trivyignore | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.trivyignore b/.trivyignore
index f68839a..eff8e1d 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -6,3 +6,10 @@
 # open on purpose (standard outbound for the managed instance). Consumers can
 # tighten egress when required — kept flexible by design.
 AVD-AWS-0104
+
+# AVD-DS-0002 — the worker images build on the shared worker-bridge base, which
+# runs as root by design today (same as scopes-lambda and
+# services-postgresql-rds): the runtime user is governed by the agent's worker
+# pod securityContext/patches, not by a USER directive here. Revisit when the
+# bridge ships a non-root variant.
+AVD-DS-0002