add vex support

.env.example

@@ -41,6 +41,12 @@ IGNORE_UNFIXED=false
 # Optional: restrict which severities Trivy reports (empty = all).
 TRIVY_SEVERITIES=
 
+# Optional: VEX sources passed to `trivy image --vex`, space separated.
+# Use "repo", "oci", "sbom-ref", local file paths, or a combination.
+# Mount local files into the container first (e.g. ./vex:/vex:ro).
+# TRIVY_VEX=repo
+# TRIVY_VEX=/vex/app.json
+
 # How many findings to list in the notification body.
 MAX_FINDINGS_IN_BODY=15