add vex support

tests/test_scan.py

@@ -291,6 +291,7 @@ class SettingsTests(unittest.TestCase):
             "FAIL_ON": "NONE",
             "IGNORE_UNFIXED": "true",
             "MAX_FINDINGS_IN_BODY": "3",
+            "TRIVY_VEX": "/vex/app.json repo",
         }
         with mock.patch.dict(os.environ, env, clear=False):
             settings = scan.Settings.from_env([])
@@ -298,6 +299,7 @@ class SettingsTests(unittest.TestCase):
         self.assertEqual(settings.fail_rank, 0)
         self.assertTrue(settings.ignore_unfixed)
         self.assertEqual(settings.max_findings, 3)
+        self.assertEqual(settings.trivy_vex, ["/vex/app.json", "repo"])
 
     def test_settings_rejects_unknown_severity(self) -> None:
         with mock.patch.dict(os.environ, {"NOTIFY_MIN_SEVERITY": "SEVERE"}, clear=False):
@@ -380,6 +382,32 @@ class ReportTests(unittest.TestCase):
         self.assertIn("no fix available", body)
 
 
+class TrivyCommandTests(unittest.TestCase):
+    def test_run_trivy_passes_vex_sources_in_order(self) -> None:
+        settings = scan.Settings(
+            explicit_images=[], trivy_vex=["/vex/app.json", "repo"]
+        )
+        completed = subprocess.CompletedProcess([], 0, stdout="", stderr="")
+        with mock.patch.object(scan.subprocess, "run", return_value=completed) as run:
+            status, _ = scan.run_trivy("nginx:1.27", settings)
+
+        command = run.call_args.args[0]
+        self.assertEqual(status, 0)
+        positions = [index for index, arg in enumerate(command) if arg == "--vex"]
+        self.assertEqual(
+            [command[index + 1] for index in positions],
+            ["/vex/app.json", "repo"],
+        )
+
+    def test_run_trivy_omits_vex_when_not_configured(self) -> None:
+        settings = scan.Settings(explicit_images=[])
+        completed = subprocess.CompletedProcess([], 0, stdout="", stderr="")
+        with mock.patch.object(scan.subprocess, "run", return_value=completed) as run:
+            scan.run_trivy("nginx:1.27", settings)
+
+        self.assertNotIn("--vex", run.call_args.args[0])
+
+
 class MainFlowTests(unittest.TestCase):
     """End-to-end runs of main() with fake trivy/apprise binaries."""