From 3ae20135a9fbb2e60c524d831feadf385dbfc082 Mon Sep 17 00:00:00 2001 From: Paulo Freitas Date: Tue, 22 Sep 2026 16:23:41 -0300 Subject: [PATCH] fix(docs): stop Cloudflare rewriting version refs as email addresses MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The published guide was serving the line that teaches people how to consume the Action as: Quando alguém escreve uses: Tooark/[email protected] Cloudflare proxies tooark.com, and its Email Address Obfuscation rewrites anything shaped like an address. "ci-security-scanner@v1.1.0" qualifies — the dots in the version make the right-hand side look like a domain, which is why "@v4" and "@sha256" elsewhere on the page came through untouched. Two spans were affected: the prose above and a label in the flow diagram. Both now carry Cloudflare's documented email_off opt-out, with a note next to them so the wrappers survive the next version bump. The markers are HTML comments, so the underlying text is unchanged and check-sync.sh still reads the pinned version out of the file. Also fixes the compare links at the bottom of CHANGELOG.md. Both pointed at a v1.0.0 tag that was never pushed — 1.0.0 was folded into the initial commits and the code first reached consumers as 1.1.0 — so both 404'd. Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 16 +++++++++++++--- docs/index.html | 12 +++++++++--- 2 files changed, 22 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 87ad810..cf7b6ad 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,15 @@ All notable changes to this project are documented here. The format follows ## [Unreleased] +### Fixed + +- The onboarding guide no longer serves `uses: Tooark/ci-security-scanner@v1.1.0` + as `[email protected]`. Cloudflare proxies `tooark.com` and its Email Address + Obfuscation rewrites anything shaped like an address; `name@vX.Y.Z` qualifies. + The affected spans now carry Cloudflare's `email_off` opt-out. +- The `[1.0.0]` and `[1.1.0]` links at the bottom of this file pointed at a + `v1.0.0` tag that was never pushed, so both 404'd. + ## [1.1.0] - 2026-09-22 ### Added @@ -56,7 +65,8 @@ All notable changes to this project are documented here. The format follows ## [1.0.0] - 2026-09-21 -First release. Pins `ghcr.io/tooark/security-scanner:1.9`. +First release. Pins `ghcr.io/tooark/security-scanner:1.9`. Never published as +a tag — this content first reached consumers as part of 1.1.0. ### Added @@ -97,5 +107,5 @@ First release. Pins `ghcr.io/tooark/security-scanner:1.9`. writing findings into an uploaded artifact. [Unreleased]: https://github.com/Tooark/ci-security-scanner/compare/v1.1.0...HEAD -[1.1.0]: https://github.com/Tooark/ci-security-scanner/compare/v1.0.0...v1.1.0 -[1.0.0]: https://github.com/Tooark/ci-security-scanner/releases/tag/v1.0.0 +[1.1.0]: https://github.com/Tooark/ci-security-scanner/releases/tag/v1.1.0 +[1.0.0]: https://github.com/Tooark/ci-security-scanner/commit/56263b1c4c085d5ce785ed263194c04609b8f0be diff --git a/docs/index.html b/docs/index.html index 1f76f87..cc998de 100644 --- a/docs/index.html +++ b/docs/index.html @@ -891,7 +891,13 @@

Mapa do repositório

- + +
05

A fachada GitHub: action.yml

@@ -900,7 +906,7 @@

A fachada GitHub: action.yml

- Quando alguém escreve uses: Tooark/ci-security-scanner@v1.1.0, o GitHub baixa este + Quando alguém escreve uses: Tooark/ci-security-scanner@v1.1.0, o GitHub baixa este repositório e executa os passos declarados aqui dentro do job de quem chamou. O arquivo tem quatro blocos.

@@ -1065,7 +1071,7 @@

O caminho completo de uma execução

1 workflow do time - uses: ...@v1.1.0 + uses: ...@v1.1.0 with: command, image