fix(fs): skip unreadable files and directories during filesystem walk

[kevglynn]

Description

When trivy fs walks a filesystem and hits a file or directory that cannot be read (e.g. lstat: input/output error on special files when scanning a Windows filesystem mounted on Linux, or paths exceeding PATH_MAX), the whole scan is aborted with unknown error with <path>.

These entries cannot be analyzed anyway, so this PR skips them with a debug log instead of halting the traversal:

• An error passed to the WalkDirFunc for a non-root path (failed lstat/ReadDir) now skips that entry.
• A failed d.Info() call now skips that file.
• Errors with the root itself are still returned, since the scan cannot continue without it (and permission errors keep their existing handling).

Before

$ trivy fs -q --format json ./volume
2026-07-08T13:18:50-04:00 FATAL Fatal error run error: fs scan error: scan error: scan failed: failed analysis: analyze with traversal: walk dir error: unknown error with /tmp/deep-repro/ddd...ddd: open /tmp/deep-repro/ddd...ddd: file name too long

(The scan dies and produces no results, even though readable lockfiles exist elsewhere in the tree. The same happens with lstat ...: input/output error from the original issue.)

After

$ trivy fs -q --format json ./volume
(exit code 0; the readable part of the tree is scanned: package-lock.json with its packages is reported)

With --debug:

2026-07-08T13:19:26-04:00 DEBUG Skipping unreadable path file_path="/tmp/deep-repro/ddd...ddd" err="open /tmp/deep-repro/ddd...ddd: file name too long"

Related issues

• Close Trivy filesystem scan failing for Windows os filesystem #3259

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

Made with Cursor