add vex support

README.md

@@ -16,7 +16,9 @@ host only needs Docker. JSON reports are kept on disk for auditing.
 1. `scan.py` determines which images to scan (see
    [Which images are scanned](#which-images-are-scanned)) and runs
    `trivy image` for each of them, writing a JSON report to
-   `/reports/<image>.json`.
+   `/reports/<image>.json`. Optional VEX sources are applied through Trivy's
+   `--vex` flag, so findings marked as not affected are filtered out before
+   counting and notifying (see [VEX](#vex)).
 2. It counts findings per severity and checks them against two thresholds:
    - `NOTIFY_MIN_SEVERITY` (default `HIGH`) – when to send an Apprise alert.
    - `FAIL_ON` (default `HIGH`) – when the script should exit with code `1`
@@ -142,6 +144,7 @@ All configuration is done through environment variables.
 | `FAIL_ON` | `HIGH` | Exit `1` when a finding at/above this severity exists. `NONE` never fails. |
 | `IGNORE_UNFIXED` | `false` | Skip vulnerabilities without a fixed version. |
 | `TRIVY_SEVERITIES` | *(all)* | Restrict severities Trivy reports, e.g. `HIGH,CRITICAL`. |
+| `TRIVY_VEX` | – | VEX sources passed to Trivy: `repo`, `oci`, `sbom-ref`, or file paths. |
 | `NOTIFY_ON_SCAN_ERROR` | `true` | Also alert when Trivy itself fails (e.g. image pull error). |
 | `REPORT_DIR` | `/reports` | Where JSON reports are written. |
 | `TRIVY_CACHE_DIR` | `/var/lib/trivy` | Trivy DB cache (mount a volume to avoid re-downloading). |
@@ -153,6 +156,39 @@ Images can be passed as arguments, via `IMAGES`, or via `IMAGES_FILE`; the
 sources are combined and de-duplicated. If all of them are empty, the images in
 use are scanned.
 
+### VEX
+
+Trivy can filter findings with [VEX](https://trivy.dev/docs/latest/supply-chain/vex/)
+(Vulnerability Exploitability eXchange) documents. Set `TRIVY_VEX` to one or
+more space-separated sources; each is passed to `trivy image --vex`:
+
+```dotenv
+# VEX Hub / repository lookup
+TRIVY_VEX=repo
+
+# VEX attestations attached to the image in an OCI registry
+TRIVY_VEX=oci
+
+# Local OpenVEX or CycloneDX VEX documents (mount them into the container)
+TRIVY_VEX=/vex/app.json /vex/base.json
+
+# Several methods; the first source has the highest priority
+TRIVY_VEX="/vex/app.json repo"
+```
+
+For local files with Compose, mount the directory read-only:
+
+```yaml
+volumes:
+  - ./vex:/vex:ro
+environment:
+  TRIVY_VEX: /vex/app.json
+```
+
+Findings suppressed by VEX are removed from the Trivy JSON report and are
+therefore not counted, notified, or considered by `FAIL_ON`. The report still
+reflects the filtered result.
+
 ### Apprise URLs
 
 `APPRISE_URLS` accepts any [Apprise URL](https://github.com/caronc/apprise/wiki).