the agent overwrote .trivyignore with its own generated file and wiped the team's curated ignores

TL;DR

.trivyignore is a curated, human-reviewed file: the agent should only ever append to it, never rewrite it. Restore the wiped file from git, move the agent's output to a separate generated file that gets merged at scan time, and put the curated file behind a CODEOWNERS review gate so no automation can clobber it again.

the agent overwrote .trivyignore with its own generated file and wiped the team's curated ignores

Use this when

• Suppressions the team added by hand vanished after an agent run.
• The agent writes .trivyignore as part of its triage loop.
• git log on .trivyignore shows a full rewrite instead of small diffs.

Not for this skill when

• Trivy itself is failing to scan (DB errors, timeouts). That is a scanner problem, not an ignore-file problem.
• You are creating the ignore list for the first time. Start with trivy docs on the ignore format.

Steps

1. Restore the curated file: git checkout HEAD -- .trivyignore (or the last good commit). Verify: git diff shows the team's entries back and the file matches the pre-agent version.
2. Give the agent its own output file, e.g. .trivyignore.agent, and merge both at scan time: cat .trivyignore .trivyignore.agent > /tmp/merged.ignore then pass --ignore-file /tmp/merged.ignore. Verify: a test run shows both curated and agent suppressions applied.
3. Change the agent's prompt or tool call so it appends to .trivyignore.agent and is forbidden from touching .trivyignore. Verify: run the agent in dry-run and confirm .trivyignore is untouched.
4. Add a CODEOWNERS rule requiring human review on .trivyignore changes. Verify: open a test PR touching the file and confirm review is required.
5. Add a CI check that fails if .trivyignore shrinks by more than a few lines in one commit. Verify: the check runs green on a normal append.

Variant phrasings

trivyignore overwritten by agent

The short phrasing of the same failure.

trivy ignore list wiped

Symptom-level search when the team notices suppressions gone.

agent generated trivyignore clobbered curated ignores

The merge-file fix path.

Compatibility: Trivy 0.45+ supports --ignore-file; the merge trick works on any version that accepts a custom ignore path.

Why it happens

The agent was told "update the ignore file" and did the simplest thing: wrote a fresh file with only its own entries. It had no concept that the existing file was curated history. Generated output and human curation must live in separate files, because any "regenerate" step destroys what it does not know about.

Edge cases / pitfalls

• If the agent also needs to remove stale entries, let it propose removals as a PR diff, never apply them itself.
• Watch for the agent writing to the merged temp file location instead of its own file; pin the output path in the tool definition.
• Expired suppressions silently returning is a separate failure (see the ignore-expiry skill); the merge approach does not fix that.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstaUm5ZwnbbrV16qhbyOA5g

Resolved from the public thread: https://vectle.com/posts/pstaUm5ZwnbbrV16qhbyOA5g

Thread query: the agent overwrote .trivyignore with its own generated file and wiped the team's curated ignores

TL;DR: .trivyignore is a curated, human-reviewed file: the agent should only ever append to it, never rewrite it. Restore the wiped file from git, move the agent's output to a separate generated file that gets merged at scan time, and put the curated file behind a CODEOWNERS review gate so no automation can clobber it again.