Tooark · paulosfjunior · Sep 22, 2026 · Sep 22, 2026
@@ -6,7 +6,7 @@ contact_links:
     url: https://github.com/Tooark/ci-security-scanner/security/advisories/new
     about: Please use private security advisories, not public issues.
   - name: 📘 Onboarding guide
-    url: https://tooark.github.io/ci-security-scanner/
+    url: https://tooark.com/ci-security-scanner/
     about: What each file does and why — read this before filing a usage question.
   - name: 🐳 Issue in the scanner image itself
     url: https://github.com/Tooark/base-images/issues/new/choose

@@ -2,7 +2,7 @@
 # ci-security-scanner :: GitHub Pages
 # -----------------------------------------------------------------------------
 # Publishes docs/ as the onboarding guide at
-# https://tooark.github.io/ci-security-scanner/.
+# https://tooark.com/ci-security-scanner/.
 #
 # The artifact-based deployment needs Pages switched to the "GitHub Actions"
 # source once, under Settings > Pages. The API cannot set it, so the first run

@@ -6,6 +6,8 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+## [1.1.0] - 2026-09-22
+
 ### Added
 
 - Onboarding guide in `docs/`, deployed to GitHub Pages by
@@ -19,6 +21,12 @@ All notable changes to this project are documented here. The format follows
   scattered across header comments and README gotchas: supported platforms,
   runners and executors, the component-to-image version pairing, and the
   network destinations a scan needs.
+- `scripts/check-sync.sh` now also verifies that every copy-paste reference in
+  the README, the examples, the onboarding guide and
+  `SUPPORTED-INTEGRATIONS.md` pins `COMPONENT_VERSION`. Only the three forms a
+  reader actually copies are matched; prose explaining the tagging scheme is
+  not. Without it, a release silently left the quick start teaching the
+  previous version.
 
 ### Changed
 
@@ -32,6 +40,8 @@ All notable changes to this project are documented here. The format follows
 - This repository's own workflows moved to `actions/checkout@v7`,
   `actions/configure-pages@v6` and `actions/deploy-pages@v5`. No consumer
   impact; the runners had started warning that Node 20 is deprecated.
+- The GitHub example in `examples/` moved to `actions/checkout@v7`, so a reader
+  copying it does not start on a version the runner already warns about.
 
 ### Fixed
 
@@ -40,6 +50,9 @@ All notable changes to this project are documented here. The format follows
   `ARK_IN_*` parity check now reads names with `while read` fed by process
   substitution, which keeps the loop in the current shell so the failure flag
   survives it.
+- The onboarding guide is linked by its canonical address,
+  `https://tooark.com/ci-security-scanner/`. The `tooark.github.io` URL used
+  until now is a redirect: the organization serves Pages from a custom domain.
 
 ## [1.0.0] - 2026-09-21
 
@@ -83,5 +96,6 @@ First release. Pins `ghcr.io/tooark/security-scanner:1.9`.
   socket mount, unredacted Betterleaks output, and Trivy's secret scanner
   writing findings into an uploaded artifact.
 
-[Unreleased]: https://github.com/Tooark/ci-security-scanner/compare/v1.0.0...HEAD
+[Unreleased]: https://github.com/Tooark/ci-security-scanner/compare/v1.1.0...HEAD
+[1.1.0]: https://github.com/Tooark/ci-security-scanner/compare/v1.0.0...v1.1.0
 [1.0.0]: https://github.com/Tooark/ci-security-scanner/releases/tag/v1.0.0
@@ -9,7 +9,7 @@ GitHub composite Action. Keeping those two front ends interchangeable is the
 constraint that shapes almost every rule below.
 
 If you are new to CI pipelines, read the
-[onboarding guide](https://tooark.github.io/ci-security-scanner/) first — it
+[onboarding guide](https://tooark.com/ci-security-scanner/) first — it
 explains what each file does and why.
 
 ## Table of contents
@@ -137,7 +137,7 @@ The project follows [Semantic Versioning](https://semver.org/).
 version and the scanner image tag that every template and the Action pin:
 
 ```text
-COMPONENT_VERSION=1.0.0
+COMPONENT_VERSION=1.1.0
 SCANNER_IMAGE=ghcr.io/tooark/security-scanner
 SCANNER_VERSION=1.9
 ```

@@ -20,7 +20,7 @@ Input names, defaults and precedence are the same on both sides; only the
 syntax differs.
 
 New to CI pipelines? The
-[onboarding guide](https://tooark.github.io/ci-security-scanner/) walks through
+[onboarding guide](https://tooark.com/ci-security-scanner/) walks through
 every file in this repository and the reasoning behind each decision, written
 for readers who know software development but not CI. Source in
 [`docs/`](docs/).
@@ -57,7 +57,7 @@ Works on gitlab.com and on any instance that can reach
 
 ```yaml
 include:
-  - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.0.0/templates/full-scan.yml"
+  - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.1.0/templates/full-scan.yml"
     inputs:
       stage: test
       image: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA"
@@ -72,7 +72,7 @@ version to your instance:
 
 ```yaml
 include:
-  - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/full-scan@1.0.0
+  - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/full-scan@1.1.0
     inputs:
       image: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA"
       trivy_severity: "CRITICAL,HIGH"
@@ -85,7 +85,7 @@ include:
   with:
     fetch-depth: 0 # Betterleaks needs the full git history
 
-- uses: Tooark/ci-security-scanner@v1.0.0
+- uses: Tooark/ci-security-scanner@v1.1.0
   with:
     command: full-scan
     image: "myapp:${{ github.sha }}"
@@ -263,7 +263,7 @@ never travel as inputs. Pass them as masked CI/CD variables (GitLab) or job
 
 ```yaml
 # GitHub
-- uses: Tooark/ci-security-scanner@v1.0.0
+- uses: Tooark/ci-security-scanner@v1.1.0
   env:
     REPORT_TOKEN: ${{ secrets.REPORT_TOKEN }}
   with:

@@ -21,7 +21,7 @@ Nomes de input, defaults e precedência são os mesmos nos dois lados; só a
 sintaxe muda.
 
 Novo em pipelines? O
-[guia de onboarding](https://tooark.github.io/ci-security-scanner/) percorre
+[guia de onboarding](https://tooark.com/ci-security-scanner/) percorre
 cada arquivo deste repositório e o porquê de cada decisão, escrito para quem
 conhece desenvolvimento de software, mas não CI. Fonte em [`docs/`](docs/).
 
@@ -57,7 +57,7 @@ Funciona no gitlab.com e em qualquer instância que alcance
 
 ```yaml
 include:
-  - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.0.0/templates/full-scan.yml"
+  - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.1.0/templates/full-scan.yml"
     inputs:
       stage: test
       image: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA"
@@ -72,7 +72,7 @@ versão na sua instância:
 
 ```yaml
 include:
-  - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/full-scan@1.0.0
+  - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/full-scan@1.1.0
     inputs:
       image: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA"
       trivy_severity: "CRITICAL,HIGH"
@@ -85,7 +85,7 @@ include:
   with:
     fetch-depth: 0 # Betterleaks precisa do history completo
 
-- uses: Tooark/ci-security-scanner@v1.0.0
+- uses: Tooark/ci-security-scanner@v1.1.0
   with:
     command: full-scan
     image: "myapp:${{ github.sha }}"
@@ -263,7 +263,7 @@ ou `env` do job (GitHub) — o repasse para o container é automático:
 
 ```yaml
 # GitHub
-- uses: Tooark/ci-security-scanner@v1.0.0
+- uses: Tooark/ci-security-scanner@v1.1.0
   env:
     REPORT_TOKEN: ${{ secrets.REPORT_TOKEN }}
   with:

@@ -8,7 +8,7 @@ This document explains where to get help based on what you're trying to do.
 
 ## 🤔 I have a question
 
-**Read the onboarding guide first:** <https://tooark.github.io/ci-security-scanner/>
+**Read the onboarding guide first:** <https://tooark.com/ci-security-scanner/>
 
 It walks the repository file by file — what each artifact does, how the GitHub
 and GitLab front ends stay interchangeable, and the reasoning behind the
@@ -85,7 +85,7 @@ Full policy and response targets are in [`SECURITY.md`](SECURITY.md).
 
 | Audience                | Start here                                                         |
 | ----------------------- | ------------------------------------------------------------------ |
-| **New to CI pipelines** | [Onboarding guide](https://tooark.github.io/ci-security-scanner/)  |
+| **New to CI pipelines** | [Onboarding guide](https://tooark.com/ci-security-scanner/)  |
 | **Users**               | [README.md](README.md) · [README.pt-BR.md](README.pt-BR.md)        |
 | **Every input**         | The `spec:inputs` block of each file in [`templates/`](templates/) |
 | **Support boundaries**  | [SUPPORTED-INTEGRATIONS.md](SUPPORTED-INTEGRATIONS.md)             |

@@ -15,7 +15,7 @@ filled in; the `bug` template asks for exactly the fields this page indexes.
 
 | Platform                               | How it is consumed                          | Status         |
 | -------------------------------------- | ------------------------------------------- | -------------- |
-| **GitHub Actions**                     | `uses: Tooark/ci-security-scanner@v1.0.0`   | ✅ Supported   |
+| **GitHub Actions**                     | `uses: Tooark/ci-security-scanner@v1.1.0`   | ✅ Supported   |
 | **GitLab CI — remote include**         | `include: - remote: ".../templates/*.yml"`  | ✅ Supported   |
 | **GitLab CI — CI/CD Catalog**          | `include: - component: $CI_SERVER_FQDN/...` | ✅ Supported   |
 | **Direct invocation**                  | `docker run` / `src/run-scanner.sh`         | ⚠️ Best effort |

@@ -1,6 +1,6 @@
 # Single source of truth for versions in this repository.
 # scripts/check-version-sync.sh enforces that every template and action.yml
 # pins exactly SCANNER_IMAGE:SCANNER_VERSION.
-COMPONENT_VERSION=1.0.0
+COMPONENT_VERSION=1.1.0
 SCANNER_IMAGE=ghcr.io/tooark/security-scanner
 SCANNER_VERSION=1.9
@@ -599,7 +599,7 @@ <h1>ci-security-scanner<br><span class="accent">por dentro</span></h1>
     </p>
     <ul class="facts">
       <li><b>Tooark/ci-security-scanner</b></li>
-      <li>v<b>1.0.0</b></li>
+      <li>v<b>1.1.0</b></li>
       <li>scanner <b>1.9</b></li>
       <li><b>7</b> scans</li>
       <li><b>2</b> plataformas</li>
@@ -900,7 +900,7 @@ <h2>A fachada GitHub: <code>action.yml</code></h2>
       </p>
 
       <p>
-        Quando alguém escreve <code>uses: Tooark/ci-security-scanner@v1.0.0</code>, o GitHub baixa este
+        Quando alguém escreve <code>uses: Tooark/ci-security-scanner@v1.1.0</code>, o GitHub baixa este
         repositório e executa os passos declarados aqui <em>dentro do job de quem chamou</em>. O arquivo
         tem quatro blocos.
       </p>
@@ -1005,7 +1005,7 @@ <h3>Como se consome</h3>
 
 <pre><code><span class="c"># no .gitlab-ci.yml do projeto que quer ser escaneado</span>
 <span class="k">include:</span>
-  - <span class="k">remote:</span> "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.0.0/templates/full-scan.yml"
+  - <span class="k">remote:</span> "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.1.0/templates/full-scan.yml"
     <span class="k">inputs:</span>
       <span class="k">stage:</span> security
       <span class="k">image:</span> "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA"
@@ -1065,7 +1065,7 @@ <h3>O caminho completo de uma execução</h3>
           <rect x="6" y="56" width="168" height="84" rx="4" fill="var(--surface)" stroke="var(--rule)" stroke-width="1"></rect>
           <text x="90" y="42" text-anchor="middle" font-family="JetBrains Mono, monospace" font-size="11" fill="var(--accent)">1</text>
           <text x="90" y="88" text-anchor="middle" font-family="Archivo, sans-serif" font-size="14.5" font-weight="600" fill="var(--ink)">workflow do time</text>
-          <text x="90" y="108" text-anchor="middle" font-family="JetBrains Mono, monospace" font-size="11" fill="var(--ink-2)">uses: ...@v1.0.0</text>
+          <text x="90" y="108" text-anchor="middle" font-family="JetBrains Mono, monospace" font-size="11" fill="var(--ink-2)">uses: ...@v1.1.0</text>
           <text x="90" y="126" text-anchor="middle" font-family="JetBrains Mono, monospace" font-size="11" fill="var(--ink-3)">with: command, image</text>
           <line x1="174" y1="98" x2="192" y2="98" stroke="var(--rule-strong)" stroke-width="1.4" marker-end="url(#arw)"></line>
 
@@ -1170,7 +1170,7 @@ <h3>A solução</h3>
       <p>O <code>VERSION</code> é a constante única:</p>
 
 <pre><code><span class="c"># Single source of truth for versions in this repository.</span>
-COMPONENT_VERSION=1.0.0
+COMPONENT_VERSION=1.1.0
 SCANNER_IMAGE=ghcr.io/tooark/security-scanner
 SCANNER_VERSION=1.9</code></pre>
 
@@ -1462,7 +1462,7 @@ <h3>Por onde começar a ler o código</h3>
       </div>
 
       <p class="closer">
-        Guia de onboarding · Tooark/ci-security-scanner v1.0.0 · scanner 1.9<br>
+        Guia de onboarding · Tooark/ci-security-scanner v1.1.0 · scanner 1.9<br>
         A referência autoritativa de cada input é o bloco <code>spec:inputs</code> do template correspondente.
       </p>
     </section>

@@ -25,19 +25,19 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # Betterleaks walks the git history; a shallow clone hides most of it.
           fetch-depth: 0
 
       - name: Secret scan
-        uses: Tooark/ci-security-scanner@v1.0.0
+        uses: Tooark/ci-security-scanner@v1.1.0
         with:
           command: secret-scan
           artifact-name: secret-scan-reports
 
       - name: Dockerfile lint
-        uses: Tooark/ci-security-scanner@v1.0.0
+        uses: Tooark/ci-security-scanner@v1.1.0
         with:
           command: dockerfile-lint
           dockerfile: Dockerfile
@@ -52,7 +52,7 @@ jobs:
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -66,7 +66,7 @@ jobs:
 
       - name: Full security scan
         id: scan
-        uses: Tooark/ci-security-scanner@v1.0.0
+        uses: Tooark/ci-security-scanner@v1.1.0
         env:
           # Secrets travel through env, never through inputs.
           REPORT_TOKEN: ${{ secrets.REPORT_TOKEN }}
@@ -97,11 +97,11 @@ jobs:
     name: Advisory scan
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Filesystem scan
         id: fs
-        uses: Tooark/ci-security-scanner@v1.0.0
+        uses: Tooark/ci-security-scanner@v1.1.0
         with:
           command: filesystem-scan
           soft-fail: "true"

@@ -72,7 +72,7 @@ Once the first release lands, projects on the instance include it by path:
 
 ```yaml
 include:
-  - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/full-scan@1.0.0
+  - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/full-scan@1.1.0
     inputs:
       image: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA"
       trivy_severity: "CRITICAL,HIGH"

@@ -11,7 +11,7 @@ stages:
 
 include:
   # Full combo on the default branch and on tags.
-  - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/full-scan@1.0.0
+  - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/full-scan@1.1.0
     inputs:
       stage: security
       image: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA"
@@ -23,7 +23,7 @@ include:
         - if: $CI_COMMIT_TAG
 
   # Fast feedback on merge requests: secrets and Dockerfile lint only.
-  - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/secret-scan@1.0.0
+  - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/secret-scan@1.1.0
     inputs:
       job_name: "security:secrets-mr"
       stage: security
@@ -32,7 +32,7 @@ include:
       rules:
         - if: $CI_PIPELINE_SOURCE == "merge_request_event"
 
-  - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/dockerfile-lint@1.0.0
+  - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/dockerfile-lint@1.1.0
     inputs:
       job_name: "security:lint-mr"
       stage: security

@@ -27,7 +27,7 @@ include:
   # ---------------------------------------------------------------------------
   # Everything at once: image + source + secrets + Dockerfile lint.
   # ---------------------------------------------------------------------------
-  - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.0.0/templates/full-scan.yml"
+  - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.1.0/templates/full-scan.yml"
     inputs:
       stage: security
       image: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA"
@@ -40,7 +40,7 @@ include:
   # ---------------------------------------------------------------------------
   # A second, faster job that runs on merge requests only: secrets, no image.
   # ---------------------------------------------------------------------------
-  - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.0.0/templates/secret-scan.yml"
+  - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.1.0/templates/secret-scan.yml"
     inputs:
       job_name: "security:secrets-mr"
       stage: security