Adds .trivyignore and use it in the scan (#1520)

Signed-off-by: Marinov Avgustin <[email protected]>

.github/workflows/.trivyignore

@@ -0,0 +1,5 @@
+# org.springframework:spring-web:5.3.31.RELEASE, ineffective vulnerability - hawkBit doesn't use beans of type HttpInvokerServiceExporter in applications
+CVE-2016-1000027
+
+# org.yaml:snakeyaml:1.33, ineffective vulnerability - Not applicable. Applications does not consume user-provided YAML data
+CVE-2022-1471

.github/workflows/trivy-scan.yml

@@ -32,7 +32,8 @@ jobs:
           mvn clean install -DskipTests && \
           cd hawkbit-runtime/docker/docker_build && \
           chmod +x build_all_dev.sh && \
-          ./build_all_dev.sh
+          ./build_all_dev.sh && \
+          cd ../../..
 
       - name: Determine most recent Trivy version
         run: |
@@ -48,7 +49,7 @@ jobs:
           mkdir -p scans/eclipse/hawkbit
           for IMAGE in $(docker image ls --format "{{.Repository}}:{{.Tag}}" "hawkbit/hawkbit-*:latest"); do
             echo "Scanning image ${IMAGE} ..."
-            ./trivy image "${IMAGE}" --ignore-unfixed --severity HIGH,CRITICAL --vuln-type library --output "scans/eclipse/$IMAGE.sarif" --format sarif
+            ./trivy image "${IMAGE}" --ignore-unfixed --ignorefile .github/workflows/.trivyignore --severity HIGH,CRITICAL --vuln-type library --output "scans/eclipse/$IMAGE.sarif" --format sarif
           done
 
       - name: Upload Docker image scan results to GitHub Security tab