feat(scan): expand manifest coverage, add Kubernetes/Helm, OCI enrichment, and .gitignore respect

Detection & parsing:
- Kubernetes manifests (Pod/Deployment/ReplicaSet/StatefulSet/DaemonSet/Job/
  CronJob incl. init & ephemeral containers) and Helm charts (Chart.yaml deps +
  values.yaml images) -> pkg:oci / pkg:helm components
- New ecosystems: Conda (environment.yml), Clojure (project.clj/deps.edn/bb.edn),
  Python setuptools (setup.py/setup.cfg), C# *.fsproj/*.vbproj/packages.config,
  npm-shrinkwrap.json, mill build.sc
- Registry-config detection (.npmrc/.yarnrc/settings.gradle) surfaces
  private/custom registry endpoints as a supply-chain signal (never tokens)

OCI enrichment:
- Every container image carries registryType (dockerhub/gcr/ecr/acr/ghcr/
  gitlab/quay/local/private) and IsPrivateRegistry, emitted as CycloneDX
  component properties

.gitignore respect:
- New internal/ignore matcher (nested, negation, anchoring, dir-only, ** globs)
- Default-on for sast/secrets/containers/iac/cbom/aibom; sca and malscan are
  exempt (they target commonly-gitignored install dirs)
- Flags: --include-ignored (scan) and per-mode --<mode>-include-ignored

Full integration across detector, parsers, purl/registry attribution, package-
manager binary capability, malscan install dirs, and CLI docs.

Author: 0x73746F66

cmd/aibom.go

@@ -68,6 +68,7 @@ func init() {
 	aibomCmd.Flags().Bool("no-commits", false, "Skip the git commit-history detection pass")
 	aibomCmd.Flags().Int("commit-scan-max", 2000, "Maximum number of commits (from HEAD) the commit-history pass inspects")
 	aibomCmd.Flags().Bool("no-upload", false, "Do not submit the AIBOM to Vulnetix (it is submitted automatically when authenticated)")
+	aibomCmd.Flags().Bool("aibom-include-ignored", false, "Include files matched by .gitignore (default: gitignored paths are skipped)")
 	rootCmd.AddCommand(aibomCmd)
 }
 
@@ -89,6 +90,7 @@ func runAIBOM(cmd *cobra.Command, args []string) error {
 	noCommits, _ := cmd.Flags().GetBool("no-commits")
 	commitMax, _ := cmd.Flags().GetInt("commit-scan-max")
 	noUpload, _ := cmd.Flags().GetBool("no-upload")
+	includeIgnored, _ := cmd.Flags().GetBool("aibom-include-ignored")
 
 	switch outputFmt {
 	case "pretty", "table", "json", "cyclonedx-json":
@@ -111,15 +113,16 @@ func runAIBOM(cmd *cobra.Command, args []string) error {
 	}
 
 	det, err := aibom.Detect(aibom.Options{
-		Root:        rootPath,
-		MaxDepth:    depth,
-		Ignore:      ignore,
-		ScanEnv:     !noEnv,
-		IncludeHome: includeHome,
-		ScanSource:  !noSource,
-		ScanCommits: !noCommits,
-		CommitMax:   commitMax,
-		Catalog:     compiled,
+		Root:             rootPath,
+		MaxDepth:         depth,
+		Ignore:           ignore,
+		ScanEnv:          !noEnv,
+		IncludeHome:      includeHome,
+		ScanSource:       !noSource,
+		ScanCommits:      !noCommits,
+		CommitMax:        commitMax,
+		Catalog:          compiled,
+		RespectGitignore: !includeIgnored,
 	})
 	if err != nil {
 		return err

cmd/cbom.go

@@ -75,6 +75,7 @@ func init() {
 	cbomCmd.Flags().Bool("no-deps", false, "Skip the crypto-library detection pass")
 	cbomCmd.Flags().String("fail-on", "none", "Exit non-zero when crypto of these PQC statuses is found: none, quantum-vulnerable, deprecated (comma-separated)")
 	cbomCmd.Flags().Bool("no-upload", false, "Do not submit the CBOM to Vulnetix (it is submitted automatically when authenticated)")
+	cbomCmd.Flags().Bool("cbom-include-ignored", false, "Include files matched by .gitignore (default: gitignored paths are skipped)")
 	rootCmd.AddCommand(cbomCmd)
 }
 
@@ -96,6 +97,7 @@ func runCBOM(cmd *cobra.Command, args []string) error {
 	noDeps, _ := cmd.Flags().GetBool("no-deps")
 	failOnRaw, _ := cmd.Flags().GetString("fail-on")
 	noUpload, _ := cmd.Flags().GetBool("no-upload")
+	includeIgnored, _ := cmd.Flags().GetBool("cbom-include-ignored")
 
 	switch outputFmt {
 	case "pretty", "table", "json", "cyclonedx-json":
@@ -122,14 +124,15 @@ func runCBOM(cmd *cobra.Command, args []string) error {
 	}
 
 	det, err := cbom.Detect(cbom.Options{
-		Root:       rootPath,
-		MaxDepth:   depth,
-		Ignore:     ignore,
-		ScanSource: !noSource,
-		ScanConfig: !noConfig,
-		ScanCerts:  !noCerts,
-		ScanDeps:   !noDeps,
-		Catalog:    compiled,
+		Root:             rootPath,
+		MaxDepth:         depth,
+		Ignore:           ignore,
+		ScanSource:       !noSource,
+		ScanConfig:       !noConfig,
+		ScanCerts:        !noCerts,
+		ScanDeps:         !noDeps,
+		Catalog:          compiled,
+		RespectGitignore: !includeIgnored,
 	})
 	if err != nil {
 		return err

cmd/cli_sca.go

@@ -1394,6 +1394,12 @@ func registryForEcosystem(eco string) string {
 		return "https://packagist.org"
 	case "nuget", ".net":
 		return "https://www.nuget.org"
+	case "conda":
+		return "https://repo.anaconda.com/pkgs/main"
+	case "clojars", "clojure":
+		return "https://repo.clojars.org"
+	case "helm":
+		return "https://artifacthub.io"
 	}
 	return ""
 }
@@ -1417,6 +1423,12 @@ func providerForEcosystem(eco string) string {
 		return "Packagist"
 	case "nuget", ".net":
 		return "NuGet"
+	case "conda":
+		return "Anaconda"
+	case "clojars", "clojure":
+		return "Clojars"
+	case "helm":
+		return "Artifact Hub"
 	}
 	return ""
 }

cmd/scan.go

@@ -414,6 +414,16 @@ func runScanWithFeatures(ctx context.Context, cmd *cobra.Command, noSAST, noSCA,
 	yes, _ := cmd.Flags().GetBool("yes")
 	pathExplicit := cmd.Flags().Changed("path")
 
+	// gitignore respect: the SAST-family walks (sast/secrets/containers/iac,
+	// and the generic scan's SAST engine) honour .gitignore by default. sca is
+	// exempt — dependency manifests routinely live in gitignored install dirs —
+	// and so the shared manifest walk only prunes .gitignore for the standalone
+	// containers/iac commands (where SCA is not consuming its output). Users opt
+	// back in with --include-ignored (generic) or --<mode>-include-ignored.
+	includeIgnored := includeIgnoredForScan(cmd)
+	respectGitignoreSAST := !includeIgnored
+	respectGitignoreManifest := !includeIgnored && (cmd.Name() == "containers" || cmd.Name() == "iac")
+
 	// Org quality-gate enforcement override. Applied after all nine control
 	// flags are read but BEFORE any is consumed (sca-autofix strategy parsing
 	// below, runLocalScan, and the gate options). For an authenticated org with
@@ -528,16 +538,38 @@ func runScanWithFeatures(ctx context.Context, cmd *cobra.Command, noSAST, noSCA,
 
 	// ── 2. Discover files ──────────────────────────────────────────────
 	files, err := scan.WalkForScanFiles(scan.WalkOptions{
-		RootPath: scanPath,
-		MaxDepth: depth,
-		Excludes: excludes,
+		RootPath:         scanPath,
+		MaxDepth:         depth,
+		Excludes:         excludes,
+		RespectGitignore: respectGitignoreManifest,
 	})
 	if err != nil {
 		return fmt.Errorf("failed to scan directory: %w", err)
 	}
 
 	analytics.TrackScan("sbom", len(files))
 
+	// Surface private/custom package registries declared in .npmrc / .yarnrc /
+	// settings.gradle as a supply-chain signal (informational; never gates).
+	if endpoints := scan.SummarizeRegistryConfigs(files); len(endpoints) > 0 {
+		var privates []scan.RegistryEndpoint
+		for _, e := range endpoints {
+			if e.Private {
+				privates = append(privates, e)
+			}
+		}
+		if len(privates) > 0 && !resultsOnly {
+			fmt.Fprintf(os.Stderr, "Registry config: %d private/custom registry endpoint(s) declared:\n", len(privates))
+			for _, e := range privates {
+				scopeNote := ""
+				if e.Scope != "" {
+					scopeNote = " (" + e.Scope + ")"
+				}
+				fmt.Fprintf(os.Stderr, "  %s%s → %s [%s]\n", e.Ecosystem, scopeNote, e.URL, e.Source)
+			}
+		}
+	}
+
 	// ── Local malware scan (malscan-engine, in-process) ─────────────────
 	// Runs as a pass on `scan`; on `sca` only when --block-malware / org
 	// blockMalware is in effect (see shouldRunMalscanPass). It scans the
@@ -694,6 +726,7 @@ func runScanWithFeatures(ctx context.Context, cmd *cobra.Command, noSAST, noSCA,
 		gitHistory,
 		gitHistoryMaxCommits,
 		gitHistoryMaxFiles,
+		respectGitignoreSAST,
 	)
 
 	return mergeMalscanBreach(scanErr, malscanBreach)
@@ -798,6 +831,7 @@ func runLocalScan(
 	gitHistory bool,
 	gitHistoryMaxCommits int,
 	gitHistoryMaxFiles int,
+	respectGitignore bool,
 ) (retErr error) {
 	dctx := display.NewWithProgress(display.ModeText, silent, noProgress)
 	scanProgress := dctx.Progress("Scan", 7)
@@ -1215,6 +1249,7 @@ func runLocalScan(
 						gitHistory,
 						gitHistoryMaxCommits,
 						gitHistoryMaxFiles,
+						respectGitignore,
 					)
 				}
 			}
@@ -1423,6 +1458,7 @@ func runLocalScan(
 				GitHistory:           enableGitHistory && gitHistory,
 				GitHistoryMaxCommits: gitHistoryMaxCommits,
 				GitHistoryMaxFiles:   gitHistoryMaxFiles,
+				RespectGitignore:     respectGitignore,
 			})
 			// Hint the caller that the synthetic-content behaviour was engaged.
 			if enableBinaryInspection && !ignoreBinaries {
@@ -4326,6 +4362,8 @@ func addScanFlags(cmd *cobra.Command) {
 		"Cap the number of commits walked during the git-history secrets stage (0 = no cap)")
 	cmd.Flags().Int("git-history-max-files", 5000,
 		"Cap the number of file versions extracted from git history (0 = no cap)")
+	cmd.Flags().Bool("include-ignored", false,
+		"Include files matched by .gitignore. By default the SAST, secrets, containers and IaC passes skip gitignored paths; sca and malscan always scan them (dependency install dirs are commonly gitignored).")
 	_ = cmd.Flags().MarkDeprecated("format", "use --output instead")
 	_ = cmd.RegisterFlagCompletionFunc("sca-autofix-strategy", cobra.FixedCompletions(
 		[]string{"stable", "safest", "latest"}, cobra.ShellCompDirectiveNoFileComp))
@@ -4338,6 +4376,21 @@ func addScanFlags(cmd *cobra.Command) {
 	_ = cmd.MarkFlagDirname("path")
 }
 
+// includeIgnoredForScan reports whether the user asked to include .gitignored
+// paths, honouring both the generic --include-ignored flag and the per-mode
+// alias (e.g. --sast-include-ignored) registered on specialized subcommands.
+func includeIgnoredForScan(cmd *cobra.Command) bool {
+	for _, name := range []string{"include-ignored", cmd.Name() + "-include-ignored"} {
+		if cmd.Flags().Lookup(name) == nil {
+			continue
+		}
+		if v, _ := cmd.Flags().GetBool(name); v {
+			return true
+		}
+	}
+	return false
+}
+
 // addSASTFlags registers SAST-specific flags on cmd.
 func addSASTFlags(cmd *cobra.Command) {
 	cmd.Flags().Bool("disable-default-rules", false, "Skip built-in default SAST rules")
@@ -4371,7 +4424,7 @@ func filterFilesByFeature(files []scan.DetectedFile, noSCA, noContainers, noIAC
 			continue
 		}
 		lang := f.ManifestInfo.Language
-		isContainer := lang == "docker"
+		isContainer := lang == "docker" || lang == "kubernetes" || lang == "helm"
 		isIAC := lang == "hcl" || lang == "nix"
 		isSCA := !isContainer && !isIAC
 		if isContainer && noContainers {

cmd/specialized_scans.go

@@ -182,6 +182,11 @@ func init() {
 	for _, cmd := range []*cobra.Command{secretsCmd, containersCmd, iacCmd, sastCmd} {
 		addScanFlags(cmd)
 		addSASTFlags(cmd)
+		// Per-mode .gitignore override alias. The generic --include-ignored
+		// registered by addScanFlags also works, but the named flag reads more
+		// naturally on a specialized command and is what the docs advertise.
+		cmd.Flags().Bool(cmd.Name()+"-include-ignored", false,
+			"Include files matched by .gitignore in this "+cmd.Name()+" scan (default: gitignored paths are skipped)")
 		rootCmd.AddCommand(cmd)
 	}
 }

internal/aibom/aibomgen/main.go

@@ -331,6 +331,7 @@ vulnetix aibom [path] [flags]
 | ` + "`--no-source`" + ` | bool | ` + "`false`" + ` | Skip the source-code SDK / model detection pass |
 | ` + "`--no-commits`" + ` | bool | ` + "`false`" + ` | Skip the git commit-history detection pass |
 | ` + "`--commit-scan-max`" + ` | int | ` + "`2000`" + ` | Max commits (from HEAD) the commit-history pass inspects |
+| ` + "`--aibom-include-ignored`" + ` | bool | ` + "`false`" + ` | Include files matched by ` + "`.gitignore`" + ` (default: gitignored paths are skipped) |
 
 ## Output
 

internal/aibom/detect.go

@@ -43,6 +43,9 @@ type Options struct {
 	Catalog   *CompiledCatalog
 	// Environ is injectable for tests; defaults to os.Environ() when nil.
 	Environ []string
+	// RespectGitignore prunes .gitignored paths (default off; the aibom command
+	// sets it true unless --aibom-include-ignored is passed).
+	RespectGitignore bool
 }
 
 // Detect runs the enabled passes and returns CycloneDX-ready detections.
@@ -72,9 +75,10 @@ func Detect(opts Options) (cdx.AIDetections, error) {
 		depth = defaultMaxDepth
 	}
 	input, err := sast.BuildScanInputWithOptions(abs, sast.BuildOptions{
-		MaxDepth:    depth,
-		IgnoreGlobs: opts.Ignore,
-		IgnoreGit:   true,
+		MaxDepth:         depth,
+		IgnoreGlobs:      opts.Ignore,
+		IgnoreGit:        true,
+		RespectGitignore: opts.RespectGitignore,
 	})
 	if err != nil {
 		return cdx.AIDetections{}, err

internal/cbom/cbomgen/main.go

@@ -319,6 +319,7 @@ vulnetix cbom [path] [flags]
 | ` + "`--no-deps`" + ` | bool | ` + "`false`" + ` | Skip the crypto-library detection pass |
 | ` + "`--fail-on`" + ` | string | ` + "`none`" + ` | Exit non-zero when crypto of these PQC statuses is found (e.g. ` + "`quantum-vulnerable`, `deprecated`" + `) |
 | ` + "`--no-upload`" + ` | bool | ` + "`false`" + ` | Do not submit the CBOM to Vulnetix (submitted automatically when authenticated) |
+| ` + "`--cbom-include-ignored`" + ` | bool | ` + "`false`" + ` | Include files matched by ` + "`.gitignore`" + ` (default: gitignored paths are skipped) |
 
 ## Output
 

internal/cbom/detect.go

@@ -34,6 +34,9 @@ type Options struct {
 	ScanDeps    bool
 	IncludeHome bool
 	Catalog     *CompiledCatalog
+	// RespectGitignore prunes .gitignored paths (default off; the cbom command
+	// sets it true unless --cbom-include-ignored is passed).
+	RespectGitignore bool
 }
 
 // Detect runs the enabled passes and returns CycloneDX-ready crypto detections.
@@ -55,9 +58,10 @@ func Detect(opts Options) (cdx.CryptoDetections, error) {
 		depth = defaultMaxDepth
 	}
 	input, err := sast.BuildScanInputWithOptions(abs, sast.BuildOptions{
-		MaxDepth:    depth,
-		IgnoreGlobs: opts.Ignore,
-		IgnoreGit:   true,
+		MaxDepth:         depth,
+		IgnoreGlobs:      opts.Ignore,
+		IgnoreGit:        true,
+		RespectGitignore: opts.RespectGitignore,
 	})
 	if err != nil {
 		return cdx.CryptoDetections{}, err

internal/cdx/local.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net/url"
 	"sort"
+	"strconv"
 	"strings"
 	"time"
 
@@ -155,6 +156,13 @@ func BuildFromLocalScan(results []LocalScanResult, specVersion string, scanCtx *
 					Value: pkg.SourceFile,
 				})
 			}
+			// Container-image registry provenance (oci ecosystem only).
+			if compType == "container" && pkg.RegistryType != "" {
+				comp.Properties = append(comp.Properties,
+					Property{Name: "vulnetix:oci:registryType", Value: pkg.RegistryType},
+					Property{Name: "vulnetix:oci:private", Value: strconv.FormatBool(pkg.IsPrivateRegistry)},
+				)
+			}
 			for _, cs := range pkg.Checksums {
 				switch cs.Alg {
 				case "SHA-256", "SHA-1":
@@ -476,6 +484,13 @@ func localEcosystemToPurlType(ecosystem string) string {
 		return "hex"
 	case "swift":
 		return "swift"
+	case "helm":
+		return "helm"
+	case "conda":
+		return "conda"
+	case "clojars", "clojure":
+		// Clojure coordinates are Maven group:artifact pairs.
+		return "maven"
 	default:
 		return ecosystem
 	}