Use extra ignore file for nancy checks

CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- Update `architect` version to [`v6.6.0`](https://github.com/giantswarm/architect/releases/tag/v6.6.0).
+  - Update `nancy` to `v1.0.37`.
+- Use an additional nancy exclude vulnerabilities file at the root of the repositories: `.nancy-ignore.generated`. If the file does not exist, nancy will ignore it. The standard `.nancy-ignore` file should contain the repository specific excludes and `.nancy-ignore.generated` is a generated one that should contain globally ignored vulnerabilities, if any.
+
 ## [4.23.0] - 2022-06-22
 
 ### Changed

src/commands/go-test.yaml

@@ -20,6 +20,6 @@ steps:
   - run: |
       CGO_ENABLED=0 golangci-lint run -E gosec -E goconst
   - run: |
-      CGO_ENABLED=0 go list -json -m all | nancy sleuth --skip-update-check --quiet --exclude-vulnerability-file ./.nancy-ignore
+      CGO_ENABLED=0 go list -json -m all | nancy sleuth --skip-update-check --quiet --exclude-vulnerability-file ./.nancy-ignore --additional-exclude-vulnerability-files ./.nancy-ignore.generated
   - run: |
       CGO_ENABLED=0 go test -ldflags "$(cat .ldflags)" ./...

src/executors/architect.yaml

@@ -1,3 +1,3 @@
 docker:
   - entrypoint: /bin/bash
-    image: quay.io/giantswarm/architect:6.4.0
+    image: quay.io/giantswarm/architect:6.6.0