add vex support

docker-compose.yml

@@ -12,6 +12,8 @@ services:
       FAIL_ON: ${FAIL_ON:-HIGH}
       IGNORE_UNFIXED: ${IGNORE_UNFIXED:-false}
       TRIVY_SEVERITIES: ${TRIVY_SEVERITIES:-}
+      # Optional: "repo", "oci", "sbom-ref" or local VEX file paths.
+      TRIVY_VEX: ${TRIVY_VEX:-}
       MAX_FINDINGS_IN_BODY: ${MAX_FINDINGS_IN_BODY:-15}
       NOTIFY_ON_SCAN_ERROR: ${NOTIFY_ON_SCAN_ERROR:-true}
       TRIVY_TIMEOUT: ${TRIVY_TIMEOUT:-15m}
@@ -37,6 +39,8 @@ services:
       # Remove this line if you do not want the host's runtime dirs exposed.
       # - /run/user:/run/user:ro
       - ${KOMODO_CACHE_DIR:-.}/cves/reports:/reports
+      # Optional: local VEX documents, referenced as /vex/<file> in TRIVY_VEX.
+      # - ./vex:/vex:ro
       # Keep the Trivy DB between runs (much faster repeat scans).
       - trivy-cache:/var/lib/trivy
     restart: "no"