Feature Request: Ignore everything in .gitignore

[madflow]

• As far as I understand, ignored files from git are included in a filesystem scan.
• It would be great, to exclude everything in .gitignore`.
• This way directories like node_modules would be exluded.
• Also false-positves would not occur, when storing secret locally for development, which are ignored by git.
• Tools like "ripgrep" already to this, maybe interresting to look sideways for a possible cli implementation.

[knqyf263]

Sounds interesting. But node_modules are actually needed for scanning, and we have some such examples like /virtualenv. It means Trivy needs to scan files even excluded by .gitignore. Need to think about how to process .gitignore.

[madflow]

@knqyf263 I am not quite sure, why scanning a vendor directory like node_modules is desireable. I have to ignore it in our codebase, so the scan will succeed on time ("filesystem scan error: scan error: scan failed:!"). Surely this is due our vast dependency tree.

I probably only see my use case at hand - I would applaude a feature like this.

Maybe "opting in" could make sense? For the technical part - there is a package which sounds helpfull: https://pkg.go.dev/github.com/denormal/go-gitignore

[knqyf263]

why scanning a vendor directory like node_modules is desireable.

package-lock.json doesn't have information about package licenses. We need to collect that from node_modules/**/package.json.