security: Trivy ko gate banaya, registry asli TLS hostname par, base image patched

.trivyignore

@@ -0,0 +1,5 @@
+# Yahan sirf wo CVE daalo jinka business ne risk accept kiya hai.
+# Format: ek line me ek CVE id, uske upar comment me kyun aur kab tak.
+# Misaal:
+#   # CVE-2024-12345 - sirf us feature me hai jo hum use nahi karte. Review: 2026-12-01
+#   CVE-2024-12345

Dockerfile

@@ -1,5 +1,12 @@
 FROM python:3.12-slim
 
+# Base image hafton purana ho sakta hai. Security updates yahin laga do,
+# warna pipeline ka Trivy gate HIGH/CRITICAL par build rok dega.
+RUN apt-get update \
+ && apt-get upgrade -y \
+ && apt-get autoremove -y --purge \
+ && rm -rf /var/lib/apt/lists/*
+
 WORKDIR /srv
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt

Jenkinsfile

@@ -7,7 +7,7 @@ pipeline {
     }
 
     environment {
-        REGISTRY   = '51.195.4.170:5000'
+        REGISTRY   = 'ns31240276.ip-51-195-4.eu:5000'
         IMAGE_NAME = 'swim/demo-app'
         VAULT_ADDR = 'http://vault:8200'
         // Jenkins container ka workspace /var/jenkins_home/... hai, par docker
@@ -122,15 +122,17 @@ print('  Vault se registry creds mil gaye (user=%s)' % d['username'])
             when { expression { env.IS_ROLLBACK != 'true' } }
             steps {
                 sh '''
-                    # Trivy ko docker socket chahiye taaki local image scan kar sake.
-                    # Cache volume se dobara download nahi hoga.
+                    # GATE hai, report nahi: HIGH/CRITICAL mila to build yahin fail hogi.
+                    # Jo CVE business ne accept kiye hain wo .trivyignore me hain.
                     docker run --rm \
                       -v /var/run/docker.sock:/var/run/docker.sock \
                       -v trivy-cache:/root/.cache/ \
+                      -v "$PWD/.trivyignore:/.trivyignore:ro" \
                       aquasec/trivy:0.58.1 image \
                         --severity ${TRIVY_SEVERITY} \
                         --ignore-unfixed \
-                        --exit-code 0 \
+                        --ignorefile /.trivyignore \
+                        --exit-code 1 \
                         --format table \
                         ${REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}
                 '''

deploy/deploy.yml

@@ -5,7 +5,7 @@
   gather_facts: true
 
   vars:
-    registry: "51.195.4.170:5000"
+    registry: "ns31240276.ip-51-195-4.eu:5000"
     image_name: "swim/demo-app"
     image_tag: "{{ lookup('env', 'IMAGE_TAG') | default('latest', true) }}"
     container_name: "demo-app"