diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index 940c9dd..f65ff1b 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -6,7 +6,7 @@ contact_links: url: https://github.com/Tooark/ci-security-scanner/security/advisories/new about: Please use private security advisories, not public issues. - name: 📘 Onboarding guide - url: https://tooark.github.io/ci-security-scanner/ + url: https://tooark.com/ci-security-scanner/ about: What each file does and why — read this before filing a usage question. - name: 🐳 Issue in the scanner image itself url: https://github.com/Tooark/base-images/issues/new/choose diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 4389fdb..fecec4f 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -2,7 +2,7 @@ # ci-security-scanner :: GitHub Pages # ----------------------------------------------------------------------------- # Publishes docs/ as the onboarding guide at -# https://tooark.github.io/ci-security-scanner/. +# https://tooark.com/ci-security-scanner/. # # The artifact-based deployment needs Pages switched to the "GitHub Actions" # source once, under Settings > Pages. The API cannot set it, so the first run diff --git a/CHANGELOG.md b/CHANGELOG.md index bb735c0..87ad810 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,8 @@ All notable changes to this project are documented here. The format follows ## [Unreleased] +## [1.1.0] - 2026-09-22 + ### Added - Onboarding guide in `docs/`, deployed to GitHub Pages by @@ -19,6 +21,12 @@ All notable changes to this project are documented here. The format follows scattered across header comments and README gotchas: supported platforms, runners and executors, the component-to-image version pairing, and the network destinations a scan needs. +- `scripts/check-sync.sh` now also verifies that every copy-paste reference in + the README, the examples, the onboarding guide and + `SUPPORTED-INTEGRATIONS.md` pins `COMPONENT_VERSION`. Only the three forms a + reader actually copies are matched; prose explaining the tagging scheme is + not. Without it, a release silently left the quick start teaching the + previous version. ### Changed @@ -32,6 +40,8 @@ All notable changes to this project are documented here. The format follows - This repository's own workflows moved to `actions/checkout@v7`, `actions/configure-pages@v6` and `actions/deploy-pages@v5`. No consumer impact; the runners had started warning that Node 20 is deprecated. +- The GitHub example in `examples/` moved to `actions/checkout@v7`, so a reader + copying it does not start on a version the runner already warns about. ### Fixed @@ -40,6 +50,9 @@ All notable changes to this project are documented here. The format follows `ARK_IN_*` parity check now reads names with `while read` fed by process substitution, which keeps the loop in the current shell so the failure flag survives it. +- The onboarding guide is linked by its canonical address, + `https://tooark.com/ci-security-scanner/`. The `tooark.github.io` URL used + until now is a redirect: the organization serves Pages from a custom domain. ## [1.0.0] - 2026-09-21 @@ -83,5 +96,6 @@ First release. Pins `ghcr.io/tooark/security-scanner:1.9`. socket mount, unredacted Betterleaks output, and Trivy's secret scanner writing findings into an uploaded artifact. -[Unreleased]: https://github.com/Tooark/ci-security-scanner/compare/v1.0.0...HEAD +[Unreleased]: https://github.com/Tooark/ci-security-scanner/compare/v1.1.0...HEAD +[1.1.0]: https://github.com/Tooark/ci-security-scanner/compare/v1.0.0...v1.1.0 [1.0.0]: https://github.com/Tooark/ci-security-scanner/releases/tag/v1.0.0 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index ccbca18..75a22d1 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -9,7 +9,7 @@ GitHub composite Action. Keeping those two front ends interchangeable is the constraint that shapes almost every rule below. If you are new to CI pipelines, read the -[onboarding guide](https://tooark.github.io/ci-security-scanner/) first — it +[onboarding guide](https://tooark.com/ci-security-scanner/) first — it explains what each file does and why. ## Table of contents @@ -137,7 +137,7 @@ The project follows [Semantic Versioning](https://semver.org/). version and the scanner image tag that every template and the Action pin: ```text -COMPONENT_VERSION=1.0.0 +COMPONENT_VERSION=1.1.0 SCANNER_IMAGE=ghcr.io/tooark/security-scanner SCANNER_VERSION=1.9 ``` diff --git a/README.md b/README.md index fd6f49f..aaebe3c 100644 --- a/README.md +++ b/README.md @@ -20,7 +20,7 @@ Input names, defaults and precedence are the same on both sides; only the syntax differs. New to CI pipelines? The -[onboarding guide](https://tooark.github.io/ci-security-scanner/) walks through +[onboarding guide](https://tooark.com/ci-security-scanner/) walks through every file in this repository and the reasoning behind each decision, written for readers who know software development but not CI. Source in [`docs/`](docs/). @@ -57,7 +57,7 @@ Works on gitlab.com and on any instance that can reach ```yaml include: - - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.0.0/templates/full-scan.yml" + - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.1.0/templates/full-scan.yml" inputs: stage: test image: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA" @@ -72,7 +72,7 @@ version to your instance: ```yaml include: - - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/full-scan@1.0.0 + - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/full-scan@1.1.0 inputs: image: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA" trivy_severity: "CRITICAL,HIGH" @@ -85,7 +85,7 @@ include: with: fetch-depth: 0 # Betterleaks needs the full git history -- uses: Tooark/ci-security-scanner@v1.0.0 +- uses: Tooark/ci-security-scanner@v1.1.0 with: command: full-scan image: "myapp:${{ github.sha }}" @@ -263,7 +263,7 @@ never travel as inputs. Pass them as masked CI/CD variables (GitLab) or job ```yaml # GitHub -- uses: Tooark/ci-security-scanner@v1.0.0 +- uses: Tooark/ci-security-scanner@v1.1.0 env: REPORT_TOKEN: ${{ secrets.REPORT_TOKEN }} with: diff --git a/README.pt-BR.md b/README.pt-BR.md index 3ddbdaf..1618c3b 100644 --- a/README.pt-BR.md +++ b/README.pt-BR.md @@ -21,7 +21,7 @@ Nomes de input, defaults e precedência são os mesmos nos dois lados; só a sintaxe muda. Novo em pipelines? O -[guia de onboarding](https://tooark.github.io/ci-security-scanner/) percorre +[guia de onboarding](https://tooark.com/ci-security-scanner/) percorre cada arquivo deste repositório e o porquê de cada decisão, escrito para quem conhece desenvolvimento de software, mas não CI. Fonte em [`docs/`](docs/). @@ -57,7 +57,7 @@ Funciona no gitlab.com e em qualquer instância que alcance ```yaml include: - - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.0.0/templates/full-scan.yml" + - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.1.0/templates/full-scan.yml" inputs: stage: test image: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA" @@ -72,7 +72,7 @@ versão na sua instância: ```yaml include: - - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/full-scan@1.0.0 + - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/full-scan@1.1.0 inputs: image: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA" trivy_severity: "CRITICAL,HIGH" @@ -85,7 +85,7 @@ include: with: fetch-depth: 0 # Betterleaks precisa do history completo -- uses: Tooark/ci-security-scanner@v1.0.0 +- uses: Tooark/ci-security-scanner@v1.1.0 with: command: full-scan image: "myapp:${{ github.sha }}" @@ -263,7 +263,7 @@ ou `env` do job (GitHub) — o repasse para o container é automático: ```yaml # GitHub -- uses: Tooark/ci-security-scanner@v1.0.0 +- uses: Tooark/ci-security-scanner@v1.1.0 env: REPORT_TOKEN: ${{ secrets.REPORT_TOKEN }} with: diff --git a/SUPPORT.md b/SUPPORT.md index 984b1b0..60adc0f 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -8,7 +8,7 @@ This document explains where to get help based on what you're trying to do. ## 🤔 I have a question -**Read the onboarding guide first:** +**Read the onboarding guide first:** It walks the repository file by file — what each artifact does, how the GitHub and GitLab front ends stay interchangeable, and the reasoning behind the @@ -85,7 +85,7 @@ Full policy and response targets are in [`SECURITY.md`](SECURITY.md). | Audience | Start here | | ----------------------- | ------------------------------------------------------------------ | -| **New to CI pipelines** | [Onboarding guide](https://tooark.github.io/ci-security-scanner/) | +| **New to CI pipelines** | [Onboarding guide](https://tooark.com/ci-security-scanner/) | | **Users** | [README.md](README.md) · [README.pt-BR.md](README.pt-BR.md) | | **Every input** | The `spec:inputs` block of each file in [`templates/`](templates/) | | **Support boundaries** | [SUPPORTED-INTEGRATIONS.md](SUPPORTED-INTEGRATIONS.md) | diff --git a/SUPPORTED-INTEGRATIONS.md b/SUPPORTED-INTEGRATIONS.md index d652296..774087a 100644 --- a/SUPPORTED-INTEGRATIONS.md +++ b/SUPPORTED-INTEGRATIONS.md @@ -15,7 +15,7 @@ filled in; the `bug` template asks for exactly the fields this page indexes. | Platform | How it is consumed | Status | | -------------------------------------- | ------------------------------------------- | -------------- | -| **GitHub Actions** | `uses: Tooark/ci-security-scanner@v1.0.0` | ✅ Supported | +| **GitHub Actions** | `uses: Tooark/ci-security-scanner@v1.1.0` | ✅ Supported | | **GitLab CI — remote include** | `include: - remote: ".../templates/*.yml"` | ✅ Supported | | **GitLab CI — CI/CD Catalog** | `include: - component: $CI_SERVER_FQDN/...` | ✅ Supported | | **Direct invocation** | `docker run` / `src/run-scanner.sh` | ⚠️ Best effort | diff --git a/VERSION b/VERSION index 36175ac..d918070 100644 --- a/VERSION +++ b/VERSION @@ -1,6 +1,6 @@ # Single source of truth for versions in this repository. # scripts/check-version-sync.sh enforces that every template and action.yml # pins exactly SCANNER_IMAGE:SCANNER_VERSION. -COMPONENT_VERSION=1.0.0 +COMPONENT_VERSION=1.1.0 SCANNER_IMAGE=ghcr.io/tooark/security-scanner SCANNER_VERSION=1.9 diff --git a/docs/index.html b/docs/index.html index c5d4433..1f76f87 100644 --- a/docs/index.html +++ b/docs/index.html @@ -599,7 +599,7 @@

ci-security-scanner
por dentro