chore: using main devguard scanner

timbastin · timbastin · commit c0d051408d10 · 2026-04-28T10:02:31.000+02:00
diff --git a/.github/workflows/attest.yml b/.github/workflows/attest.yml
@@ -87,7 +87,7 @@ jobs:
         echo "Resolved artifact name for attestation: ${{ inputs.artifact-name }}"
         
     - name: Get and Attest SBOM
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:v1.3.0
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
       with:
         args: |
           sh -c "
@@ -108,7 +108,7 @@ jobs:
         API_ARTIFACT_NAME: ${{ env.API_ARTIFACT_NAME }}
         ARTIFACT_NAME: ${{ env.ARTIFACT_NAME }}
     - name: Get and Attest VeX
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:v1.3.0
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
       with:
         args: |
           sh -c "
@@ -129,7 +129,7 @@ jobs:
         API_ARTIFACT_NAME: ${{ env.API_ARTIFACT_NAME }}
         ARTIFACT_NAME: ${{ env.ARTIFACT_NAME }}
     - name: Get and Attest SAST-Results
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:v1.3.0
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
       with:
         args: |
           sh -c "
@@ -153,7 +153,7 @@ jobs:
       with:
         name: build${{ inputs.image-suffix }}.provenance.json
     - name: Attest build-provenance.json
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:v1.3.0
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
       continue-on-error: true
       with:
         args: |
diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml
@@ -74,7 +74,7 @@ jobs:
 
     - name: In-Toto Provenance record start
       id: in-toto-start
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:v1.3.0
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
       with:
         args: devguard-scanner intoto start --step=build --token=${{ secrets.devguard-token }} --apiUrl=${{ inputs.api-url }} --assetName=${{ inputs.asset-name }} --supplyChainId=${{ github.sha }}
       continue-on-error: true
@@ -110,7 +110,7 @@ jobs:
         docker run --rm \
           -v "$GITHUB_WORKSPACE:/workspace" \
           -w /workspace \
-          ghcr.io/l3montree-dev/devguard/scanner:v1.3.0 \
+          ghcr.io/l3montree-dev/devguard/scanner:main \
           crane digest --tarball="${IMAGE_DESTINATION_PATH}" > image-digest.txt
       env:
         IMAGE_DESTINATION_PATH: ${{ inputs.image-destination-path }}
@@ -142,7 +142,7 @@ jobs:
           docker run --rm \
             -e IMAGE_PATH \
             -e GITHUB_REF_NAME \
-            ghcr.io/l3montree-dev/devguard/scanner:v1.3.0 \
+            ghcr.io/l3montree-dev/devguard/scanner:main \
             devguard-scanner generate-tag \
               --imagePath="$IMAGE_PATH" \
               --ref="$GITHUB_REF_NAME" \
@@ -164,7 +164,7 @@ jobs:
         docker run --rm \
           --user 53111:53111 \
           -v "${HOME}/.docker:/tmp/.docker" \
-          ghcr.io/l3montree-dev/devguard/scanner:v1.3.0 \
+          ghcr.io/l3montree-dev/devguard/scanner:main \
           crane auth login ghcr.io -u ${{ github.actor }} -p ${{ github.token }}
       if: inputs.disable-artifact-registry-as-image-store == true
 
@@ -174,7 +174,7 @@ jobs:
           -v "$GITHUB_WORKSPACE:/workspace" \
           -w /workspace \
           -v "${HOME}/.docker:/tmp/.docker:ro" \
-          ghcr.io/l3montree-dev/devguard/scanner:v1.3.0 \
+          ghcr.io/l3montree-dev/devguard/scanner:main \
           crane push "${IMAGE_DESTINATION_PATH}" "$(cat image-tag.txt)"
       env:
         IMAGE_DESTINATION_PATH: ${{ inputs.image-destination-path }}
@@ -223,7 +223,7 @@ jobs:
         path: image-tag.txt
 
     - name: In-Toto Provenance record stop
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:v1.3.0
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
       with:
         args: devguard-scanner intoto stop --step=build --products=image-digest.txt --products=image-tag.txt --token=${{ secrets.devguard-token }} --apiUrl=${{ inputs.api-url }} --assetName=${{ inputs.asset-name }} --supplyChainId=${{ github.sha }} --generateSlsaProvenance --defaultRef=${{ github.event.repository.default_branch }} --isTag=${{ github.ref_type == 'tag' }} --ref=${{ github.ref_name }}
       continue-on-error: true
diff --git a/.github/workflows/code-risk-identification.yml b/.github/workflows/code-risk-identification.yml
@@ -46,6 +46,6 @@ jobs:
       if: ${{ inputs.sarif-artifact-name != '' }}  
 
     - name: DevGuard Code Risk Identification
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:v1.3.0
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
       with:
         args: devguard-scanner sarif ${{ inputs.sarif-file }} --assetName=${{ inputs.asset-name }}  --apiUrl=${{ inputs.api-url }} --token="${{ secrets.devguard-token }}" --defaultRef=${{ github.event.repository.default_branch }} --isTag=${{ github.ref_type == 'tag' }} --ref=${{ github.ref_name }} --webUI=${{ inputs.web-ui }}
diff --git a/.github/workflows/container-scanning.yml b/.github/workflows/container-scanning.yml
@@ -97,7 +97,7 @@ jobs:
       if: inputs.fetch-image-from-registry == true
 
     - name: DevGuard Container-Scanning
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:v1.3.0
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
       with:
         args: devguard-scanner container-scanning --assetName=${{ inputs.asset-name }}   --apiUrl=${{ inputs.api-url }} --token="${{ secrets.devguard-token }}" --path=${{ inputs.image-path }} --defaultRef=${{ github.event.repository.default_branch }} --isTag=${{ github.ref_type == 'tag' }} --ref=${{ github.ref_name }} --failOnRisk=${{ inputs.fail-on-risk }} --failOnCVSS=${{ inputs.fail-on-cvss }} --artifactName=${{ env.ARTIFACT_NAME }} --webUI=${{ inputs.web-ui }}
       env:
diff --git a/.github/workflows/dependency-risk-identification.yml b/.github/workflows/dependency-risk-identification.yml
@@ -63,6 +63,6 @@ jobs:
       if: ${{ inputs.sbom-artifact-name != '' }}
 
     - name: DevGuard Dependency Risk Identification
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:v1.3.0
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
       with:
         args: devguard-scanner sbom ${{ inputs.sbom-file }} --assetName=${{ inputs.asset-name }}  --apiUrl=${{ inputs.api-url }} --token="${{ secrets.devguard-token }}" --defaultRef=${{ github.event.repository.default_branch }} --isTag=${{ github.ref_type == 'tag' }} --ref=${{ github.ref_name }} --artifactName=${{ inputs.artifact-name }} --webUI=${{ inputs.web-ui }} --failOnRisk=${{ inputs.fail-on-risk }} --failOnCVSS=${{ inputs.fail-on-cvss }}
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -73,7 +73,7 @@ jobs:
       run: echo "DIGEST=$(cat image-digest.txt)" >> $GITHUB_ENV
     
     - name: In-Toto Provenance run
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:v1.3.0
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
       with:
         args: devguard-scanner intoto run --step=deploy --materials=image-tag.txt --products=image-tag.txt --products=image-digest.txt --token=${{ secrets.devguard-token }} --apiUrl=${{ inputs.api-url }} --assetName=${{ inputs.asset-name }} --supplyChainId=${{ github.sha }} --supplyChainOutputDigest="${{ env.DIGEST }}" --defaultRef=${{ github.event.repository.default_branch }} --isTag=${{ github.ref_type == 'tag' }} --ref=${{ github.ref_name }}
       continue-on-error: true
diff --git a/.github/workflows/iac.yml b/.github/workflows/iac.yml
@@ -39,7 +39,7 @@ jobs:
         persist-credentials: false
         fetch-depth: 0
     - name: DevGuard Infrastructure as Code
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:v1.3.0
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
       continue-on-error: ${{ inputs.continue-on-open-code-risk }}
       with:
         args: devguard-scanner iac --assetName=${{ inputs.asset-name }}   --apiUrl=${{ inputs.api-url }} --token="${{ secrets.devguard-token }}" --path=${{ inputs.path }} --defaultRef=${{ github.event.repository.default_branch }} --isTag=${{ github.ref_type == 'tag' }} --ref=${{ github.ref_name }} --webUI=${{ inputs.web-ui }}
diff --git a/.github/workflows/secret-scanning.yml b/.github/workflows/secret-scanning.yml
@@ -40,7 +40,7 @@ jobs:
         persist-credentials: false
       uses: actions/checkout@v4
     - name: DevGuard Secret-Scanning
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:v1.3.0
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
       continue-on-error: ${{ inputs.continue-on-open-code-risk }}
       with:
         args: devguard-scanner secret-scanning --assetName=${{ inputs.asset-name }} --apiUrl=${{ inputs.api-url }} --token="${{ secrets.devguard-token }}" --path=${{ inputs.path }} --defaultRef=${{ github.event.repository.default_branch }} --isTag=${{ github.ref_type == 'tag' }} --ref=${{ github.ref_name }} --webUI=${{ inputs.web-ui }}
diff --git a/.github/workflows/sign.yml b/.github/workflows/sign.yml
@@ -58,6 +58,6 @@ jobs:
       run: echo "IMAGE_TAG_AND_DIGEST=$(cat image-tag.txt)@$(cat image-digest.txt)" >> $GITHUB_ENV
 
     - name: DevGuard Image-Signing
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:v1.3.0
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
       with:
         args: devguard-scanner sign -u ${{ github.actor }} -r ghcr.io -p ${{ secrets.GITHUB_TOKEN }} --token="${{ secrets.devguard-token }}" ${{ env.IMAGE_TAG_AND_DIGEST }} --apiUrl=${{ inputs.api-url }} --assetName=${{ inputs.asset-name }}
diff --git a/.github/workflows/software-composition-analysis.yml b/.github/workflows/software-composition-analysis.yml
@@ -47,7 +47,7 @@ jobs:
         persist-credentials: true # we need the credentials to be able to use the devguard-scanner in private repositories
       uses: actions/checkout@v4 # Check out the repository content to the runner
     - name: DevGuard SCA
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:v1.3.0
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
       with:
         args: devguard-scanner sca --assetName=${{ inputs.asset-name }}  --apiUrl=${{
           inputs.api-url }} --token="${{ secrets.devguard-token }}" --path=${{
diff --git a/.github/workflows/static-application-security-testing.yml b/.github/workflows/static-application-security-testing.yml
@@ -39,7 +39,7 @@ jobs:
         fetch-depth: 0
         persist-credentials: false
     - name: DevGuard Static application security testing
-      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:v1.3.0
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
       continue-on-error: ${{ inputs.continue-on-open-code-risk }}
       with:
         args: devguard-scanner sast --assetName=${{ inputs.asset-name }} --apiUrl=${{ inputs.api-url }} --token="${{ secrets.devguard-token }}" --path=${{ inputs.path }} --defaultRef=${{ github.event.repository.default_branch }} --isTag=${{ github.ref_type == 'tag' }} --ref=${{ github.ref_name }} --webUI=${{ inputs.web-ui }}
