chore: update deps and CI to fix govulncheck failures

.github/workflows/ci-e2e.yaml

@@ -7,19 +7,29 @@ on:
       - master
 
 jobs:
-  e2e-test:
+  e2e-matrix:
+    name: e2e (cli-scanner ${{ matrix.cli_scanner_version }})
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        cli_scanner_version:
+          - "1.29.0" # newest-version-marker — DO NOT REMOVE; auto-updated by `just update-cli-scanner`
+          - "1.23.0" # oldest-version-marker — DO NOT REMOVE; auto-updated by `just update-oldest-cli-scanner`
     defaults:
       run:
         shell: nix develop --command bash -v {0}
     timeout-minutes: 60
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install nix
-        uses: DeterminateSystems/nix-installer-action@main
+        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+
+      - name: Configure Nix cache
+        uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
 
       - name: Start Minikube (Docker driver)
         id: minikube
@@ -95,7 +105,7 @@ jobs:
             --set image.pullPolicy=Never \
             --set sysdig.secure.apiToken="$SECURE_API_TOKEN" \
             --set sysdig.secure.url="$SECURE_URL" \
-            --set cliScanning.image="quay.io/sysdig/sysdig-cli-scanner:1.25.1"
+            --set cliScanning.image="quay.io/sysdig/sysdig-cli-scanner:${{ matrix.cli_scanner_version }}"
 
       - name: Wait for Harbor to be ready
         run: |
@@ -205,3 +215,19 @@ jobs:
         if: always()
         run: |
           minikube delete || true
+
+  # Stable, matrix-independent check for branch protection: matrix legs
+  # report as "e2e (cli-scanner <version>)", so a required check pinned to
+  # a specific version string would break every time the matrix changes.
+  e2e-test:
+    name: e2e-test
+    runs-on: ubuntu-latest
+    needs: e2e-matrix
+    if: always()
+    steps:
+      - name: Require all matrix legs to have passed
+        run: |
+          if [ "${{ needs.e2e-matrix.result }}" != "success" ]; then
+            echo "e2e-matrix result: ${{ needs.e2e-matrix.result }}"
+            exit 1
+          fi

.github/workflows/ci.yaml

@@ -14,13 +14,13 @@ jobs:
         shell: nix develop --command bash {0}
     steps:
       - name: Fetch code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install nix
-        uses: DeterminateSystems/nix-installer-action@main
+        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
 
       - name: Configure Nix cache
-        uses: DeterminateSystems/magic-nix-cache-action@main
+        uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
 
       - name: Run lint
         run: |
@@ -34,17 +34,17 @@ jobs:
         shell: nix develop --command bash {0}
     steps:
       - name: Fetch code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install nix
-        uses: DeterminateSystems/nix-installer-action@main
+        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
 
       - name: Configure Nix cache
-        uses: DeterminateSystems/magic-nix-cache-action@main
+        uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
 
       - name: Run pre-commit
         run: |
-          pre-commit run -a
+          prek run -a
 
   build-and-test:
     name: Build and test
@@ -54,13 +54,13 @@ jobs:
         shell: nix develop --command bash {0}
     steps:
       - name: Fetch code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install nix
-        uses: DeterminateSystems/nix-installer-action@main
+        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
 
       - name: Configure Nix cache
-        uses: DeterminateSystems/magic-nix-cache-action@main
+        uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
 
       - name: Run tests
         run: |

.github/workflows/release.yaml

@@ -13,7 +13,7 @@ jobs:
       new-version: ${{ steps.check.outputs.new_version }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-tags: true
           fetch-depth: 0
@@ -52,13 +52,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@main
+        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
 
       - name: Configure Nix cache
-        uses: DeterminateSystems/magic-nix-cache-action@main
+        uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
 
       - name: Build
         run: nix build -L .#harbor-adapter-docker
@@ -70,7 +70,7 @@ jobs:
           docker images
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.SYSDIGLABS_DOCKERHUB_USER }}
           password: ${{ secrets.SYSDIGLABS_DOCKERHUB_TOKEN }}
@@ -88,16 +88,16 @@ jobs:
     permissions:
       contents: write # Required for release creation
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           fetch-tags: true
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@main
+        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
 
       - name: Configure Nix cache
-        uses: DeterminateSystems/magic-nix-cache-action@main
+        uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
 
       - name: Install git-chglog
         run: nix profile install nixpkgs#git-chglog
@@ -109,7 +109,7 @@ jobs:
         run: git-chglog -c .github/git-chglog/config.yml -o RELEASE_CHANGELOG.md $(git describe --tags $(git rev-list --tags --max-count=1))
 
       - name: Create release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           name: v${{ needs.get-newer-version.outputs.new-version }}
           tag_name: v${{ needs.get-newer-version.outputs.new-version }}

AGENTS.md

@@ -79,15 +79,34 @@ Three GitHub Actions workflows run on PRs to `master`:
 
 **CI (`ci.yaml`)** — three parallel jobs:
 - **Lint**: `just lint`
-- **Pre-commit**: `pre-commit run -a` (fmt, lint, trivy vulnerability scan)
+- **Pre-commit**: `prek run -a` (fmt, lint, trivy vulnerability scan)
 - **Build and test**: `just test` (requires `SECURE_API_TOKEN` and `SECURE_URL` secrets)
 
-**E2E (`ci-e2e.yaml`)** — full integration test on Minikube:
+**E2E (`ci-e2e.yaml`)** — full integration test on Minikube, run as a matrix over the newest and oldest supported `sysdig-cli-scanner` versions:
 1. Starts Minikube, installs Harbor via Helm
 2. Builds the adapter Docker image with `nix build .#harbor-adapter-docker`
-3. Deploys the scanner adapter via the `sysdig/harbor-scanner-sysdig-secure` Helm chart
+3. Deploys the scanner adapter via the `sysdig/harbor-scanner-sysdig-secure` Helm chart, setting `cliScanning.image` to `quay.io/sysdig/sysdig-cli-scanner:<matrix version>`
 4. Pushes an Alpine image to Harbor, triggers a scan, and polls the vulnerability report API until completion (30 attempts, 10s intervals)
 
+## Scanner Version Support
+
+The `sysdig-cli-scanner` is supported for **1 year after release**. The e2e matrix (`cli_scanner_version` in `ci-e2e.yaml`) pins the newest default version and the oldest still-supported version for backward-compat coverage. Two `just` recipes keep these current:
+
+```bash
+# Print the oldest version still within the support window (probes binary Last-Modified)
+just oldest-cli-scanner
+
+# Substitute the oldest supported version wherever the oldest-version-marker is placed
+just update-oldest-cli-scanner
+
+# Bump the default version to the latest available (via newest-version-marker)
+just update-cli-scanner
+```
+
+- **Version markers:** the recipes find/replace via `newest-version-marker` / `oldest-version-marker` sentinels — trailing `#`/`//` comments in YAML/TS, HTML-comment spans in Markdown. Target files are discovered by `grep`, not hardcoded, so a new marker anywhere is picked up. **Do not remove these markers** or the recipes stop updating that spot.
+- The version number comes from `https://download.sysdig.com/scanning/sysdig-cli-scanner/latest_version.txt` (same semver as the `quay.io/sysdig/sysdig-cli-scanner` image tags).
+- Both recipes run as part of `just update`. The recipes require GNU `date`/`sed` and `curl`, provided by the `nix develop` devshell.
+
 **Release (`release.yaml`)** — triggers on `package.nix` changes pushed to `master`:
 - Extracts version from `package.nix`, compares with latest git tag
 - Builds and pushes Docker image to DockerHub (`sysdiglabs/harbor-scanner-sysdig-secure`)

Justfile

@@ -1,28 +1,136 @@
 
+# Show what's available instead of forcing everyone to read the Justfile.
 [private]
 default:
 	just -l
 
+# Run the test suite.
+[group('test')]
 test:
 	ginkgo --randomize-all --randomize-suites --fail-on-pending -trace -race --show-node-events -r
 
-update:
+# Keep every pinned dependency (Go, nix, sysdig-cli-scanner) current in one go.
+[group('update')]
+update: update-cli-scanner update-oldest-cli-scanner
 	nix flake update
 	nix develop --command go get -u -t -v ./...
 	nix develop --command go mod tidy
+	nix develop --command pinact run -u
 	nix develop --command just rehash-package-nix
 
+# (internal) Print the latest published sysdig-cli-scanner version
+[group('update')]
+[private]
+_latest-version:
+	@curl -sL https://download.sysdig.com/scanning/sysdig-cli-scanner/latest_version.txt | tr -d '[:space:]'
+
+# Find the oldest sysdig-cli-scanner version still within the support window (default 365 days)
+[group('update')]
+oldest-cli-scanner window_days="365":
+	#!/usr/bin/env bash
+	set -euo pipefail
+	base="https://download.sysdig.com/scanning/bin/sysdig-cli-scanner"
+	os="linux"; arch="amd64"
+	cutoff=$(( $(date -u +%s) - {{window_days}} * 86400 ))
+	latest=$(just _latest-version)
+	major=${latest%%.*}
+	minor=$(echo "$latest" | cut -d. -f2)
+	oldest_ver=""; oldest_epoch=""
+	for m in $(seq "$minor" -1 0); do
+	    minor_hit=0; misses=0
+	    for p in $(seq 0 30); do
+	        v="$major.$m.$p"
+	        lm=$(curl -sfI "$base/$v/$os/$arch/sysdig-cli-scanner" \
+	            | grep -i '^last-modified:' | sed 's/^[Ll]ast-[Mm]odified: //' | tr -d '\r' || true)
+	        if [ -z "$lm" ]; then
+	            misses=$((misses + 1)); [ "$misses" -ge 2 ] && break; continue
+	        fi
+	        misses=0
+	        epoch=$(date -u -d "$lm" +%s)
+	        if [ "$epoch" -ge "$cutoff" ]; then
+	            minor_hit=1
+	            if [ -z "$oldest_epoch" ] || [ "$epoch" -lt "$oldest_epoch" ]; then
+	                oldest_epoch=$epoch; oldest_ver=$v
+	            fi
+	        fi
+	    done
+	    # Versions are chronological: once a whole minor is out of window, stop.
+	    [ "$minor_hit" -eq 0 ] && [ -n "$oldest_ver" ] && break
+	done
+	if [ -z "$oldest_ver" ]; then
+	    echo "No version found within the last {{window_days}} days" >&2
+	    exit 1
+	fi
+	echo >&2 "Oldest supported: $oldest_ver (released $(date -u -d "@$oldest_epoch" '+%Y-%m-%d'))"
+	echo "$oldest_ver"
+
+# (internal) Replace the version tagged with <marker>-version-marker wherever it
+# appears. Markers are HTML-comment spans in Markdown and trailing `#`/`//`
+# comments in YAML/TS. Target files are discovered, not hardcoded, so a new
+# marker anywhere is picked up automatically. DO NOT delete those markers.
+[group('update')]
+[private]
+_set-version marker version:
+	#!/usr/bin/env bash
+	set -euo pipefail
+	# Discover files carrying this marker. Skip the tooling/docs that only name
+	# the marker in prose.
+	mapfile -t files < <(grep -rl \
+	    --exclude-dir=.git \
+	    --exclude=justfile --exclude=Justfile \
+	    --exclude=AGENTS.md --exclude=CLAUDE.md \
+	    "{{marker}}-version-marker" . | sort)
+	if [ "${#files[@]}" -eq 0 ]; then
+	    echo "No files found carrying {{marker}}-version-marker" >&2
+	    exit 1
+	fi
+	for f in "${files[@]}"; do
+	    echo "Updating $f" >&2
+	    # Markdown: <!-- {{marker}}-version-marker ... -->X<!-- /{{marker}}-version-marker -->
+	    sed -i -E "s#(<!-- {{marker}}-version-marker[^>]*-->)[0-9][0-9.]*(<!-- /{{marker}}-version-marker -->)#\1{{version}}\2#g" "$f"
+	    # YAML/TS: line carrying a `#`/`//` {{marker}}-version-marker comment
+	    sed -i -E "/(#|\/\/)[[:space:]]*{{marker}}-version-marker/ s/[0-9]+\.[0-9]+\.[0-9]+/{{version}}/" "$f"
+	done
+
+# Substitute the oldest supported version wherever the oldest-version-marker is placed
+[group('update')]
+update-oldest-cli-scanner window_days="365":
+	#!/usr/bin/env bash
+	set -euo pipefail
+	oldest=$(just oldest-cli-scanner {{window_days}})
+	just _set-version oldest "$oldest"
+	echo "Oldest supported version set to $oldest (via oldest-version-marker)"
+
+# Update sysdig-cli-scanner default to the latest available version
+[group('update')]
+update-cli-scanner:
+	#!/usr/bin/env bash
+	set -euo pipefail
+	latest=$(just _latest-version)
+	just _set-version newest "$latest"
+	echo "Newest (default) version set to $latest (via newest-version-marker)"
+
+# Keep package.nix's vendorHash in sync after Go dependencies change.
+[group('update')]
 rehash-package-nix:
 	sd 'vendorHash = ".*";' 'vendorHash = "";' package.nix; h="$((nix build -L --no-link .#harbor-adapter || true) 2>&1 | sed -nE 's/.*got:[[:space:]]+([^ ]+).*/\1/p' | tail -1)"; [ -n "$h" ] && sd 'vendorHash = ".*";' "vendorHash = \"$h\";" package.nix && echo "vendorHash -> $h"
 
+# Everything that must pass before opening/merging a PR.
+[group('validate')]
 check: lint check-vulns test
 
+# Make sure no dependency has a known vulnerability.
+[group('validate')]
 check-vulns:
 	govulncheck -show=verbose -test ./...
 
+# Enforce code quality and style rules.
+[group('validate')]
 lint:
 	golangci-lint run
 
+# Keep code formatting consistent across the repo.
+[group('utils')]
 fmt:
 	go fmt ./...
 	gofumpt -w ./

docker.nix

@@ -2,9 +2,6 @@
   dockerTools,
   harbor-adapter,
   cacert,
-  bash,
-  curl,
-  coreutils,
 }:
 dockerTools.buildLayeredImage {
   name = "sysdiglabs/harbor-scanner-sysdig-secure";