add vex support

scan.py

@@ -364,6 +364,7 @@ class Settings:
     fail_on: str = "HIGH"
     ignore_unfixed: bool = False
     trivy_severities: str = ""
+    trivy_vex: list[str] = field(default_factory=list)
     notify_on_scan_error: bool = True
     report_dir: str = "/reports"
     trivy_cache_dir: str = "/var/lib/trivy"
@@ -393,6 +394,7 @@ class Settings:
             fail_on=os.environ.get("FAIL_ON", "HIGH"),
             ignore_unfixed=env_bool("IGNORE_UNFIXED", False),
             trivy_severities=os.environ.get("TRIVY_SEVERITIES", "").strip(),
+            trivy_vex=split_words(os.environ.get("TRIVY_VEX", "")),
             notify_on_scan_error=env_bool("NOTIFY_ON_SCAN_ERROR", True),
             report_dir=os.environ.get("REPORT_DIR", "/reports"),
             trivy_cache_dir=os.environ.get("TRIVY_CACHE_DIR", "/var/lib/trivy"),
@@ -549,6 +551,8 @@ def run_trivy(image: str, settings: Settings, context: str = "") -> tuple[int, s
     ]
     if settings.trivy_severities:
         command += ["--severity", settings.trivy_severities]
+    for vex_source in settings.trivy_vex:
+        command += ["--vex", vex_source]
     if settings.ignore_unfixed:
         command.append("--ignore-unfixed")
     command.append(image)
@@ -732,6 +736,9 @@ Environment:
                         (default: false).
   TRIVY_SEVERITIES      Comma separated severities Trivy should report
                         (default: empty = all severities).
+  TRIVY_VEX             Space separated VEX sources passed to Trivy as
+                        --vex: "repo", "oci", "sbom-ref" or file paths.
+                        Earlier sources take priority (default: none).
   NOTIFY_ON_SCAN_ERROR  true/false - alert when Trivy fails (default: true).
   REPORT_DIR            Directory for JSON reports (default: /reports).
   TRIVY_CACHE_DIR       Trivy database/cache directory (default: /var/lib/trivy).
@@ -763,6 +770,9 @@ def main(argv: list[str] | None = None) -> int:
 
     settings.docker_socket = find_docker_socket()
 
+    if settings.trivy_vex:
+        log("INFO", f"Applying VEX source(s): {', '.join(settings.trivy_vex)}")
+
     targets = collect_targets(settings)
     if not targets:
         return 0