From 569a366cbbab533781ac3c087bf4e93609ad903b Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Thu, 13 Aug 2026 12:48:31 -0300
Subject: [PATCH] ci: pin Trivy checks to scanner release

---
 Jenkinsfile              | 9 ++++++++-
 ci/Jenkinsfile.titan-iac | 9 ++++++++-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/Jenkinsfile b/Jenkinsfile
index 2ef693a5f..f84c6982d 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -238,9 +238,16 @@ PY
             set -euo pipefail
             mkdir -p build
             set +e
-            trivy fs --cache-dir "${TRIVY_CACHE_DIR}" --skip-db-update --skip-files clusters/atlas/flux-system/gotk-components.yaml --timeout 5m --no-progress --format json --output build/trivy-fs.json --scanners vuln,secret,misconfig --severity HIGH,CRITICAL .
+            trivy fs --cache-dir "${TRIVY_CACHE_DIR}" --skip-db-update --skip-check-update --skip-files clusters/atlas/flux-system/gotk-components.yaml --timeout 5m --no-progress --format json --output build/trivy-fs.json --scanners vuln,secret,misconfig --severity HIGH,CRITICAL .
             trivy_rc=$?
             set -e
+            if [ "${trivy_rc}" -ne 0 ]; then
+              rm -f build/trivy-fs.json
+              cat > build/ironbank-compliance.json <<EOF
+{"status":"failed","compliant":false,"scanner":"trivy","scan_type":"filesystem","error":"trivy scan failed","trivy_rc":${trivy_rc}}
+EOF
+              exit 0
+            fi
             if [ ! -s build/trivy-fs.json ]; then
               cat > build/ironbank-compliance.json <<EOF
 {"status":"failed","compliant":false,"scanner":"trivy","scan_type":"filesystem","error":"trivy did not produce JSON output","trivy_rc":${trivy_rc}}
diff --git a/ci/Jenkinsfile.titan-iac b/ci/Jenkinsfile.titan-iac
index 8e3e3f133..d4564884c 100644
--- a/ci/Jenkinsfile.titan-iac
+++ b/ci/Jenkinsfile.titan-iac
@@ -237,9 +237,16 @@ PY
             set -euo pipefail
             mkdir -p build
             set +e
-            trivy fs --cache-dir "${TRIVY_CACHE_DIR}" --skip-db-update --skip-files clusters/atlas/flux-system/gotk-components.yaml --timeout 5m --no-progress --format json --output build/trivy-fs.json --scanners vuln,secret,misconfig --severity HIGH,CRITICAL .
+            trivy fs --cache-dir "${TRIVY_CACHE_DIR}" --skip-db-update --skip-check-update --skip-files clusters/atlas/flux-system/gotk-components.yaml --timeout 5m --no-progress --format json --output build/trivy-fs.json --scanners vuln,secret,misconfig --severity HIGH,CRITICAL .
             trivy_rc=$?
             set -e
+            if [ "${trivy_rc}" -ne 0 ]; then
+              rm -f build/trivy-fs.json
+              cat > build/ironbank-compliance.json <<EOF
+{"status":"failed","compliant":false,"scanner":"trivy","scan_type":"filesystem","error":"trivy scan failed","trivy_rc":${trivy_rc}}
+EOF
+              exit 0
+            fi
             if [ ! -s build/trivy-fs.json ]; then
               cat > build/ironbank-compliance.json <<EOF
 {"status":"failed","compliant":false,"scanner":"trivy","scan_type":"filesystem","error":"trivy did not produce JSON output","trivy_rc":${trivy_rc}}