v1.3.0

What's Changed

• chore(deps): Bump actions/upload-pages-artifact from 3 to 5 by @dependabot[bot] in #13
• feat!: rename to action-security-scanner and ship the Action alone by @paulosfjunior in #14

Full Changelog: v1.2.0...v1.3.0

v1.2.0

Added

• The onboarding guide is bilingual. A language button beside the theme button
  switches between Portuguese and English without reloading the page. Both
  languages live in the same file, side by side, so they cannot drift apart the
  way two separate files can; the choice is remembered per visitor, and a
  first-time visitor gets whichever language their browser asks for. Without
  JavaScript the page still renders, in Portuguese.
• The guide links out: a GitHub button beside the language and theme buttons
  and the repository badge open the repository, the version badge opens that
  version's release, and the scanner badge opens the Tooark/base-images
  release of the image it pins.

Changed

• The onboarding guide no longer carries versions of its own. It writes
  placeholders, and scripts/render-docs.sh fills them in from VERSION —
  which now also declares REPORT_SCHEMA and REPORT_VERSION — before Pages
  publishes the page. Pages now also redeploys when only VERSION changes.
  check-sync.sh reads the rendered page, fails on a version typed into the
  guide by hand, and checks that every live mention of the report envelope
  names REPORT_VERSION.

• Scanner image bumped to ghcr.io/tooark/security-scanner:1.10, the new
  default of scanner_version / scanner-version. Its reports use the
  ark-report-tools envelope v1.3, which adds an optional image object —
  name, version, tag, digest and reference of the scanner image that
  produced the report — and sets version to "1.3". A collector behind
  report_url / report-url that only accepts the literal "1.2" must be
  updated; reports without image still validate against the new schema.
  Released as a minor because the image moved a minor: the scanner default
  follows the image's own versioning (see CONTRIBUTING.md).

• Reports say which image produced them. The image knows only its own build
  version, so both front ends pass ARK_IMAGE_NAME and ARK_IMAGE_TAG from
  scanner_image / scanner-image and scanner_version / scanner-version:
  a mirror or the floating 1.10 tag is recorded as it ran, not as
  ghcr.io/tooark/security-scanner:1.10.0. The Action also resolves the
  digest of the image it runs and passes ARK_IMAGE_DIGEST, so
  image.reference becomes an immutable name@sha256:…. GitLab exposes no
  digest for a job image; a project that wants one sets ARK_IMAGE_DIGEST as
  a CI/CD variable. A CI/CD variable, or the job env on GitHub, overrides all
  three.

Fixed

• The onboarding guide no longer serves uses: Tooark/ci-security-scanner@v1.1.0
  as [email protected]. Cloudflare proxies tooark.com and its Email Address
  Obfuscation rewrites anything shaped like an address; name@vX.Y.Z qualifies.
  The affected spans now carry Cloudflare's email_off opt-out.
• The [1.0.0] and [1.1.0] links at the bottom of this file pointed at a
  v1.0.0 tag that was never pushed, so both 404'd.
• The guide's JavaScript moved out of the page and into docs/guide.js. The
  site is served behind a Content Security Policy of script-src 'self', which
  blocks inline <script> outright — so the theme toggle, the language toggle
  and the nav highlight were all dead on the published page while working
  locally. The button labels moved into data- attributes on the buttons, so
  the script file now carries no translated text at all.
• The guide serves its own favicon. The link pointed at ../media/favicon.png,
  which resolves above the published root — docs/ is the site root — and only
  appeared to work because the organization's site happens to serve an
  identical file at that path. It also declared image/x-icon for a PNG.
• The Portuguese half of the guide had fallen behind the English one. It still
  showed v1.0.0 in both tag tables, actions/cache/restore@v4 and
  actions/checkout@v4, and it listed three check-sync.sh invariants where
  there are four. Both halves said the scanner version is pinned in ten places;
  it is nine, since run-scanner.sh has a single version fallback. On narrow
  phones the header buttons no longer overlap the eyebrow line.
• The catalog mirror's sync job could not push. GitLab Runner rewrites the
  bare project URL to one carrying CI_JOB_TOKEN
  (url.<with token>.insteadOf <without>), so the push went out with the
  read-only job token instead of CATALOG_PUSH_TOKEN and failed with
  You are not allowed to push code to this project. The push URL now carries
  a user part (https://oauth2@…), which that prefix match no longer rewrites,
  and every push resets credential.helper first, so a job-token helper the
  runner installs under FF_GIT_URLS_WITHOUT_TOKENS cannot answer instead.
• The mirror's push to the default branch carries -o ci.skip. Without it the
  push started a branch pipeline whose own sync job raced the tag push, and
  failed trying to create the same tag whenever it won.
• The README reaches the catalog mirror without media/, docs/, examples/,
  action.yml or the other language's README, so on the catalog page the
  banner and those links were broken. Links to files the mirror does not sync
  are now absolute; templates/, LICENSE and VERSION stay relative.
• The mirror's troubleshooting table blamed branch protection for the 403 that
  was really the runner's job token, and listed a missing description as a
  cause of an empty catalog, when it actually fails the release job with
  Project must have a description. It now covers both, and how to publish a
  release that was created while the CI/CD Catalog project toggle was off.

Security

• The mirror pipeline pins its images by digest: alpine:3.24.2 for sync,
  which holds CATALOG_PUSH_TOKEN (3.20 reached end of support on
  2026-04-01), and glab v1.119.0 for release instead of the mutable
  latest. The mirror's README notes that the glab path needs GitLab 18.0 or
  later.

v1.1.0

What's Changed

• fix(ci): unblock CI by fixing SC2013 in check-sync.sh by @paulosfjunior in #6
• docs: add the OSS governance files, modelled on base-images by @paulosfjunior in #7
• chore(deps): Bump actions/configure-pages from 5 to 6 by @dependabot[bot] in #1
• chore(deps): Bump actions/deploy-pages from 4 to 5 by @dependabot[bot] in #2
• chore(deps): Bump actions/checkout from 4 to 7 by @dependabot[bot] in #3
• chore(deps): Bump actions/cache from 4 to 6 by @dependabot[bot] in #4
• chore(deps): Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #5
• docs: record the minimum Actions Runner version raised by #4 and #5 by @paulosfjunior in #8
• chore(release): 1.1.0 by @paulosfjunior in #9

New Contributors

• @paulosfjunior made their first contribution in #6
• @dependabot[bot] made their first contribution in #1

Full Changelog: https://github.com/Tooark/ci-security-scanner/commits/v1.1.0