fixes wrong ref

Author: timbastin

.github/workflows/attest.yml

@@ -78,7 +78,7 @@ jobs:
         fi    
         
     - name: Get SBOM
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest-latest
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest
       with:
         args: >
           sh -c "
@@ -87,7 +87,7 @@ jobs:
       env:
         API_ARTIFACT_NAME: ${{ env.API_ARTIFACT_NAME }}
     - name: Get VeX
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest-latest
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest
       with:
         args: >
             sh -c " 
@@ -96,14 +96,14 @@ jobs:
       env:
         API_ARTIFACT_NAME: ${{ env.API_ARTIFACT_NAME }}      
     - name: Get SAST-Results
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest-latest
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest
       with:
          args: >
             sh -c " 
             slug=$(devguard-scanner slug ${{ github.ref_name }}) && devguard-scanner get '${{ inputs.api-url }}/api/v1/organizations/${{ inputs.asset-name }}/refs/'$slug'/sarif.json' --token='${{ secrets.devguard-token }}' > sarif.json
             "
     - name: Attest SBOM
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest-latest
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest
       with:
         args: >
           sh -c "
@@ -116,7 +116,7 @@ jobs:
       env:
         ARTIFACT_NAME: ${{ env.ARTIFACT_NAME }}    
     - name: Attest VeX
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest-latest
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest
       with:
         args: >
           sh -c "
@@ -129,7 +129,7 @@ jobs:
       env:
         ARTIFACT_NAME: ${{ env.ARTIFACT_NAME }}
     - name: Attest SAST-Results
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest-latest
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest
       with:
         args: >
           sh -c "
@@ -147,7 +147,7 @@ jobs:
       with:
         name: build${{ inputs.image-suffix }}.provenance.json
     - name: Attest build-provenance.json
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest-latest
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest
       continue-on-error: true
       with:
         args: >

.github/workflows/build-image.yml

@@ -63,7 +63,7 @@ jobs:
         persist-credentials: false
     - name: In-Toto Provenance record start
       id: in-toto-start
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest-latest
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest
       with:
         args: devguard-scanner intoto start --step=build --token=${{ secrets.devguard-token }} --apiUrl=${{ inputs.api-url }} --assetName=${{ inputs.asset-name }} --supplyChainId=${{ github.sha }}
       continue-on-error: true
@@ -192,7 +192,7 @@ jobs:
         path: image-tag.txt
 
     - name: In-Toto Provenance record stop
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest-latest
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest
       with:
         args: devguard-scanner intoto stop --step=build --products=image-digest.txt --products=image-tag.txt --token=${{ secrets.devguard-token }} --apiUrl=${{ inputs.api-url }} --assetName=${{ inputs.asset-name }} --supplyChainId=${{ github.sha }} --generateSlsaProvenance
       continue-on-error: true

.github/workflows/code-risk-identification.yml

@@ -46,6 +46,6 @@ jobs:
       if: ${{ inputs.sarif-artifact-name != '' }}  
 
     - name: DevGuard Code Risk Identification
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest-latest
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest
       with:
         args: devguard-scanner sarif ${{ inputs.sarif-file }} --assetName=${{ inputs.asset-name }}  --apiUrl=${{ inputs.api-url }} --token="${{ secrets.devguard-token }}" --defaultRef=${{ github.event.repository.default_branch }} --isTag=${{ github.ref_type == 'tag' }} --ref=${{ github.ref_name }} --webUI=${{ inputs.web-ui }}

.github/workflows/container-scanning.yml

@@ -97,7 +97,7 @@ jobs:
       if: inputs.fetch-image-from-registry == true
 
     - name: DevGuard Container-Scanning
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest-latest
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest
       with:
         args: devguard-scanner container-scanning --assetName=${{ inputs.asset-name }}   --apiUrl=${{ inputs.api-url }} --token="${{ secrets.devguard-token }}" --path=${{ inputs.image-path }} --defaultRef=${{ github.event.repository.default_branch }} --isTag=${{ github.ref_type == 'tag' }} --ref=${{ github.ref_name }} --failOnRisk=${{ inputs.fail-on-risk }} --failOnCVSS=${{ inputs.fail-on-cvss }} --artifactName=${{ env.ARTIFACT_NAME }} --webUI=${{ inputs.web-ui }}
       env:

.github/workflows/dependency-risk-identification.yml

@@ -63,6 +63,6 @@ jobs:
       if: ${{ inputs.sbom-artifact-name != '' }}
 
     - name: DevGuard Dependency Risk Identification
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest-latest
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest
       with:
         args: devguard-scanner sbom ${{ inputs.sbom-file }} --assetName=${{ inputs.asset-name }}  --apiUrl=${{ inputs.api-url }} --token="${{ secrets.devguard-token }}" --defaultRef=${{ github.event.repository.default_branch }} --isTag=${{ github.ref_type == 'tag' }} --ref=${{ github.ref_name }} --artifactName=${{ inputs.artifact-name }} --webUI=${{ inputs.web-ui }} --failOnRisk=${{ inputs.fail-on-risk }} --failOnCVSS=${{ inputs.fail-on-cvss }}

.github/workflows/deploy.yml

@@ -68,7 +68,7 @@ jobs:
       run: echo "DIGEST=$(cat image-digest.txt)" >> $GITHUB_ENV
 
     - name: In-Toto Provenance run
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest-latest
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest
       with:
         args: devguard-scanner intoto run --step=deploy --materials=image-tag.txt --products=image-tag.txt --products=image-digest.txt --token=${{ secrets.devguard-token }} --apiUrl=${{ inputs.api-url }} --assetName=${{ inputs.asset-name }} --supplyChainId=${{ github.sha }} --supplyChainOutputDigest="${{ env.DIGEST }}"
       continue-on-error: true

.github/workflows/iac.yml

@@ -39,7 +39,7 @@ jobs:
         persist-credentials: false
         fetch-depth: 0
     - name: DevGuard Infrastructure as Code
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest-latest
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest
       continue-on-error: ${{ inputs.continue-on-open-code-risk }}
       with:
         args: devguard-scanner iac --assetName=${{ inputs.asset-name }}   --apiUrl=${{ inputs.api-url }} --token="${{ secrets.devguard-token }}" --path=${{ inputs.path }} --defaultRef=${{ github.event.repository.default_branch }} --isTag=${{ github.ref_type == 'tag' }} --ref=${{ github.ref_name }} --webUI=${{ inputs.web-ui }}

.github/workflows/sast.yml

@@ -39,7 +39,7 @@ jobs:
         fetch-depth: 0
         persist-credentials: false
     - name: DevGuard Static application security testing
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest-latest
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest
       continue-on-error: ${{ inputs.continue-on-open-code-risk }}
       with:
         args: devguard-scanner sast --assetName=${{ inputs.asset-name }} --apiUrl=${{ inputs.api-url }} --token="${{ secrets.devguard-token }}" --path=${{ inputs.path }} --defaultRef=${{ github.event.repository.default_branch }} --isTag=${{ github.ref_type == 'tag' }} --ref=${{ github.ref_name }} --webUI=${{ inputs.web-ui }}

.github/workflows/secret-scanning.yml

@@ -40,7 +40,7 @@ jobs:
         persist-credentials: false
       uses: actions/checkout@v4
     - name: DevGuard Secret-Scanning
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest-latest
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest
       continue-on-error: ${{ inputs.continue-on-open-code-risk }}
       with:
         args: devguard-scanner secret-scanning --assetName=${{ inputs.asset-name }} --apiUrl=${{ inputs.api-url }} --token="${{ secrets.devguard-token }}" --path=${{ inputs.path }} --defaultRef=${{ github.event.repository.default_branch }} --isTag=${{ github.ref_type == 'tag' }} --ref=${{ github.ref_name }} --webUI=${{ inputs.web-ui }}

.github/workflows/sign.yml

@@ -51,6 +51,6 @@ jobs:
       run: echo "IMAGE_TAG_AND_DIGEST=$(cat image-tag.txt)@$(cat image-digest.txt)" >> $GITHUB_ENV
 
     - name: DevGuard Image-Signing
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest-latest
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main-latest
       with:
         args: devguard-scanner sign -u ${{ github.actor }} -r ghcr.io -p ${{ secrets.GITHUB_TOKEN }} --token="${{ secrets.devguard-token }}" ${{ env.IMAGE_TAG_AND_DIGEST }} --apiUrl=${{ inputs.api-url }} --assetName=${{ inputs.asset-name }}