Multiple ignorefiles are not being used

[okainov]

Description

I'd like to use multiple trivyignore files during one scan. E.g. --ignorefile .trivyignore.yaml --ignorefile ignore2.yaml

Desired Behavior

Both files should be considered for filtering

Actual Behavior

Only last specified argument from command line is taken

Reproduction Steps

1. Create .trivyignore.yaml
2. Run trivy image ubuntu:24.04 --ignorefile .trivyignoreNonExisting.yaml --ignorefile .trivyignore.yaml
3. Observe no error about non-existing .trivyignoreNonExisting.yaml which clearly indicate it's not being used at all

Target

None

Scanner

None

Output Format

None

Mode

None

Debug Output

N/A

Operating System

Ubuntu

Version

Version: 0.69.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2026-02-03 06:41:39.656167537 +0000 UTC
  NextUpdate: 2026-02-04 06:41:39.656167407 +0000 UTC
  DownloadedAt: 2026-02-03 11:20:09.307427819 +0000 UTC
Check Bundle:
  Digest: sha256:ff1f8aeb19a802446ed4125bd084f2d6f50ad6800328fee24a4bc2f5a03c23c1
  DownloadedAt: 2026-02-03 12:41:15.877081894 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[nikpivkin]

Hi @okainov !

The documentation does not indicate that the flag can be repeated, so the behavior where only the last file is loaded is expected and not considered a bug. I suggest marking this discussion as a feature request instead.

I’d also like to better understand your workflow. Why do you have multiple ignore files? Is one for your organization and the other specific to the project?

Have you considered merging the YAML files on your side and providing a single file to Trivy?

[okainov]

I’d also like to better understand your workflow. Why do you have multiple ignore files? Is one for your organization and the other specific to the project?

E.g. we're scanning "big" suite which has inputs from multiple teams, so each team provides their own triage config which we need to "apply" for the final big scan.

Have you considered merging the YAML files on your side and providing a single file to Trivy?

That's what I'll do as some kind of workaround of course (in addition to few other issues and inconveniences I observed). But it would be way more convenient if the tool itself allows it.