sysdiglabs · tembleking · Jul 9, 2026 · Jun 9, 2026 · Jul 9, 2026 · Jul 9, 2026
@@ -50,7 +50,7 @@ jobs:
           - bitnami/kubectl:latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Scan ${{ matrix.image }}
         id: scan
@@ -80,7 +80,7 @@ jobs:
     steps:
       # This step checks out a copy of your repository.
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Scan dummy-vuln-app from registry
         id: scan
@@ -111,7 +111,7 @@ jobs:
 
       - name: Upload SARIF file
         if: success() || failure() # Upload results regardless previous step fails
-        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           sarif_file: ${{ github.workspace }}/sarif.json
 
@@ -130,7 +130,7 @@ jobs:
     steps:
       # This step checks out a copy of your repository.
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Scan dummy-vuln-app from registry
         id: scan
@@ -148,7 +148,7 @@ jobs:
 
       - name: Upload SARIF file
         if: success() || failure() # Upload results regardless previous step fails
-        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           sarif_file: ${{ github.workspace }}/sarif.json
 
@@ -167,15 +167,14 @@ jobs:
     steps:
       # This step checks out a copy of your repository.
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Scan dummy-vuln-app from registry
         id: scan
         uses: ./
         continue-on-error: true
         with:
-          # Old scanner version
-          cli-scanner-version: 1.18.0
+          cli-scanner-version: 1.22.5 # oldest-version-marker — DO NOT REMOVE; auto-updated by `just update-oldest-cli-scanner`
           # Tag of the image to analyse
           image-tag: sysdiglabs/dummy-vuln-app:latest
           # API token for Sysdig Scanning auth
@@ -186,7 +185,7 @@ jobs:
 
       - name: Upload SARIF file
         if: success() || failure() # Upload results regardless previous step fails
-        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           sarif_file: ${{ github.workspace }}/sarif.json
 
@@ -205,7 +204,7 @@ jobs:
     steps:
       # This step checks out a copy of your repository.
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Donate MainDB from scan
         id: donnor-scan
@@ -233,7 +232,7 @@ jobs:
 
       - name: Upload SARIF file
         if: success() || failure() # Upload results regardless previous step fails
-        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           sarif_file: ${{ github.workspace }}/sarif.json
 
@@ -243,7 +242,7 @@ jobs:
     steps:
       # This step checks out a copy of your repository.
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Scan repository with multiple IaC policies
         id: scan
@@ -271,7 +270,7 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Scan with correct checksum
         id: scan
@@ -297,7 +296,7 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Scan with incorrect checksum
         id: scan

@@ -9,8 +9,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
       - run: npm ci

@@ -14,7 +14,7 @@ jobs:
       changes: ${{ steps.check_changes.outputs.changes }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 2
 
@@ -41,7 +41,7 @@ jobs:
       cancel-in-progress: false
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -63,7 +63,7 @@ jobs:
         run: git-chglog -c .github/git-chglog/config.yml -o RELEASE_CHANGELOG.md "${{ steps.version.outputs.version }}"
 
       - name: Create release
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           name: ${{ steps.version.outputs.version }}
           tag_name: ${{ steps.version.outputs.version }}

@@ -10,7 +10,7 @@ jobs:
     steps:
       # This step checks out a copy of your repository.
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Scan dummy-vuln-app from registry
         id: scan
@@ -26,7 +26,7 @@ jobs:
 
       - name: Upload SARIF file
         if: success() || failure() # Upload results regardless previous step fails
-        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           sarif_file: ${{ github.workspace }}/sarif.json
 
@@ -36,7 +36,7 @@ jobs:
     steps:
       # This step checks out a copy of your repository.
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Scan dummy-vuln-app from registry
         id: scan
@@ -53,7 +53,7 @@ jobs:
 
       - name: Upload SARIF file
         if: success() || failure() # Upload results regardless previous step fails
-        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           sarif_file: ${{ github.workspace }}/sarif.json
 
@@ -63,7 +63,7 @@ jobs:
     steps:
       # This step checks out a copy of your repository.
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Donate MainDB from scan
         id: donnor-scan
@@ -91,7 +91,7 @@ jobs:
 
       - name: Upload SARIF file
         if: success() || failure() # Upload results regardless previous step fails
-        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           sarif_file: ${{ github.workspace }}/sarif.json
 
@@ -101,7 +101,7 @@ jobs:
     steps:
       # This step checks out a copy of your repository.
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Scan hello-world from registry
         id: scan
@@ -118,6 +118,6 @@ jobs:
 
       - name: Upload SARIF file
         if: success() || failure() # Upload results regardless previous step fails
-        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           sarif_file: ${{ github.workspace }}/sarif.json
@@ -11,7 +11,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
         with:
           stale-issue-message: 'This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days'
           stale-pr-message: 'This PR is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days'

@@ -176,7 +176,7 @@ Tests mirror the src/ structure in `tests/`.
 The action tests itself on every PR with these scenarios:
 1. **scan-from-registry**: Basic scan with severity filter (expects failure - vuln image)
 2. **filtered-scan-from-registry**: Group-by-package mode
-3. **scan-with-old-scanner-version**: Backward compatibility (v1.18.0)
+3. **scan-with-old-scanner-version**: Backward compatibility (oldest supported version, kept current via `just update-oldest-cli-scanner`)
 4. **standalone-scan-from-registry**: Offline mode with cached DB (donor scan pattern)
 5. **scan-with-multiple-policies**: IaC mode with multiple policies
 6. **scan-with-correct-checksum**: Checksum validation success
@@ -193,6 +193,27 @@ Pattern: `continue-on-error: true` → validate outcome in follow-up step
 5. Creates GitHub release with changelog body
 6. **Force-updates major tag** (e.g., `v6`) for `uses: sysdiglabs/scan-action@v6`
 
+### Scanner Version Support
+
+The `sysdig-cli-scanner` is supported for **1 year after release**. Two `just` recipes keep this current:
+
+```bash
+# Print the oldest version still within the support window (probes binary Last-Modified)
+just oldest-cli-scanner
+
+# Substitute the oldest supported version in action.yml, README.md and the
+# scan-with-old-scanner-version CI job
+just update-oldest-cli-scanner
+
+# Bump the default version to the latest available
+just update-cli-scanner
+```
+
+- Default version lives in `src/infrastructure/sysdig/SysdigCliScannerConstants.ts` (mirrored in `action.yml`, `README.md`).
+- The oldest supported version is a moving target; re-run `just update-oldest-cli-scanner` periodically so `action.yml`, `README.md` and the CI backward-compat job track the 1-year window.
+- **Version markers:** the recipes find/replace via `newest-version-marker` / `oldest-version-marker` sentinels (HTML-comment spans in Markdown, trailing `#`/`//` comments in YAML/TS). **Do not remove these markers** or the recipes stop updating that spot. They do *not* touch checksum-pinned versions (`scan-with-correct-checksum`, `scan-with-incorrect-checksum`, `SysdigCliScannerDownloader.test.ts`), which carry a paired SHA256 and are bumped manually.
+- `update-cli-scanner` does **not** rebuild `dist/`; run `just prepare` afterwards.
+
 ### Pre-commit Hooks (`.pre-commit-config.yaml`)
 
 ```bash

@@ -10,7 +10,7 @@ This action performs analysis on a specific container image and posts the result
 |------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------|
 | `cli-scanner-url`            | URL to `sysdig-cli-scanner` binary download. The action will detect the runner OS and architecture. For more info about the Sysdig CLI Scanner download visit [the official documentation](https://docs.sysdig.com/en/docs/installation/sysdig-secure/install-vulnerability-cli-scanner/).                               |                           |
 | `mode`                       | Mode of operation. Can be "vm" or "iac".                                                                                                                                                                                                                                                                                 | `vm`                      |
-| `cli-scanner-version`        | Custom sysdig-cli-scanner version to download. Minimum required version is 1.18.0. Please note that for VM mode the Action has only been tested with the current default version and it is not guaranteed that it will work as expected with other versions.                                                             | `1.26.0`                  |
+| `cli-scanner-version`        | Custom sysdig-cli-scanner version to download. Versions are supported for 1 year after release; minimum required version is <!-- oldest-version-marker: DO NOT REMOVE; auto-updated by `just update-oldest-cli-scanner` -->1.22.5<!-- /oldest-version-marker -->. Please note that for VM mode the Action has only been tested with the current default version and it is not guaranteed that it will work as expected with other versions.                                                             | `<!-- newest-version-marker: DO NOT REMOVE; auto-updated by `just update-cli-scanner` -->1.27.2<!-- /newest-version-marker -->`                  |
 | `cli-scanner-sha256sum`      | SHA256 sum of the Sysdig CLI scanner binary to verify the download. If not provided, the action will automatically download the official checksum from Sysdig for verification. The scanner download is always verified.                                                                                             |                           |
 | `registry-user`              | Registry username to authenticate to while pulling the image to scan.                                                                                                                                                                                                                                                    |                           |
 | `registry-password`          | Registry password to authenticate to while pulling the image to scan.                                                                                                                                                                                                                                                    |                           |
@@ -136,7 +136,7 @@ The `if: success() || failure()` option makes sure the SARIF report is uploaded
       uses: sysdiglabs/scan-action@v6
       with:
         sysdig-secure-token: ${{ secrets.SYSDIG_SECURE_TOKEN }}
-        cli-scanner-version: 1.26.0
+        cli-scanner-version: 1.27.2 # newest-version-marker — DO NOT REMOVE; auto-updated by `just update-cli-scanner`
         mode: iac
         iac-scan-path: ./terraform
 ```

@@ -5,8 +5,8 @@ inputs:
     description: URL to sysdig-cli-scanner binary download
     required: false
   cli-scanner-version:
-    description: Custom sysdig-cli-scanner version to download. Oldest supported version is 1.26.0.
-    default: "1.26.0"
+    description: Custom sysdig-cli-scanner version to download. Versions are supported for 1 year after release; oldest supported version is 1.22.5. # oldest-version-marker — DO NOT REMOVE; auto-updated by `just update-oldest-cli-scanner`
+    default: "1.27.2" # newest-version-marker — DO NOT REMOVE; auto-updated by `just update-cli-scanner`
     required: false
   cli-scanner-sha256sum:
     description: 'SHA256 sum of the Sysdig CLI scanner binary to verify the download.'