From 412d04f5f680a9f42000da0bffe9740ae72ab0d9 Mon Sep 17 00:00:00 2001
From: Kuba <78603704+jakub-tldr@users.noreply.github.com>
Date: Fri, 7 Aug 2026 12:54:51 +0200
Subject: [PATCH 1/2] read trivyignore from base branch

---
 .github/workflows/sbom.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index 7f44e38..b872f0d 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -32,6 +32,11 @@ jobs:
           ref: ${{ steps.vars.outputs.TAG_NAME }}
           submodules: recursive
 
+      - name: Use current vulnerability policy from default branch
+        run: |
+          git fetch --depth=1 origin ${{ github.event.repository.default_branch }}
+          git checkout FETCH_HEAD -- .trivyignore.yaml || echo "Keeping tagged .trivyignore.yaml"
+
       - name: Create SBOM with Trivy
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         env:

From 682f9740af39765557192e7543632354788f83b9 Mon Sep 17 00:00:00 2001
From: Kuba <78603704+jakub-tldr@users.noreply.github.com>
Date: Fri, 7 Aug 2026 14:07:20 +0200
Subject: [PATCH 2/2] add guard

---
 .github/workflows/sbom.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index b872f0d..63c835f 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -33,6 +33,7 @@ jobs:
           submodules: recursive
 
       - name: Use current vulnerability policy from default branch
+        if: inputs.tag != ''
         run: |
           git fetch --depth=1 origin ${{ github.event.repository.default_branch }}
           git checkout FETCH_HEAD -- .trivyignore.yaml || echo "Keeping tagged .trivyignore.yaml"