chore: bump sysdig-cli-scanner to 1.30.1 and automate it in just update

AGENTS.md

@@ -180,6 +180,12 @@ The project uses `just` as a command runner to encapsulate common workflows.
 * `just fix`
   * Runs `cargo fix` and `cargo machete` / `cargo machete --fix` to clean up unused dependencies and minor issues.
 
+* `just update`
+  * Updates flake inputs, Cargo deps and pre-commit hooks, and runs `just update-cli-scanner`.
+
+* `just update-cli-scanner`
+  * Bumps the pinned Sysdig CLI scanner version in `src/infra/scanner_binary_manager.rs` to the latest release. It rewrites the lines tagged with `newest-version-marker`; do not remove those markers.
+
 Additional helpful commands:
 
 * `cargo test -- --nocapture` – run tests with full output when debugging.

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sysdig-lsp"
-version = "0.9.0"
+version = "0.9.1"
 edition = "2024"
 authors = [ "Sysdig Inc." ]
 readme = "README.md"

Justfile

@@ -20,3 +20,15 @@ update:
     nix flake update
     nix develop --command cargo update
     nix develop --command pre-commit autoupdate
+    nix develop --command just update-cli-scanner
+
+# Bump the pinned sysdig-cli-scanner to the latest version (lines tagged with newest-version-marker)
+update-cli-scanner:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    latest=$(curl --silent --show-error --fail --location https://download.sysdig.com/scanning/sysdig-cli-scanner/latest_version.txt | tr -d '[:space:]')
+    IFS=. read -r major minor patch <<< "$latest"
+    file=src/infra/scanner_binary_manager.rs
+    sd 'Version::new\(\d+, \d+, \d+\)(.*newest-version-marker)' "Version::new($major, $minor, $patch)\${1}" "$file"
+    sd '"\d+\.\d+\.\d+"(.*newest-version-marker)' "\"$latest\"\${1}" "$file"
+    echo "sysdig-cli-scanner -> $latest"

flake.nix

@@ -45,12 +45,14 @@
                 cargo-nextest
                 cargo-tarpaulin
                 clippy
+                curl
                 just
                 lldb
                 pre-commit
                 rust-analyzer
                 rustc
                 rustfmt
+                sd
               ];
 
               inputsFrom = [ sysdig-lsp ];

src/domain/scanresult/package_type.rs

@@ -12,6 +12,8 @@ pub enum PackageType {
     Ruby,
     Php,
     CSharp,
+    Oci,
+    SoftwareRuntime,
 }
 
 impl Display for PackageType {
@@ -30,6 +32,8 @@ impl Display for PackageType {
                 PackageType::Ruby => "ruby",
                 PackageType::Php => "php",
                 PackageType::CSharp => "csharp",
+                PackageType::Oci => "oci",
+                PackageType::SoftwareRuntime => "software runtime",
             }
         )
     }

src/infra/scanner_binary_manager.rs

@@ -44,7 +44,7 @@ pub(super) struct ScannerBinaryManager {}
 
 impl ScannerBinaryManager {
     const fn version(&self) -> Version {
-        Version::new(1, 23, 0)
+        Version::new(1, 30, 1) // newest-version-marker — DO NOT REMOVE; auto-updated by `just update-cli-scanner`
     }
 
     pub async fn install_expected_version_if_not_present(
@@ -197,7 +197,7 @@ mod tests {
     async fn it_gets_the_wanted_version() {
         let mgr = ScannerBinaryManager::default();
 
-        assert_eq!(mgr.version().to_string(), "1.23.0");
+        assert_eq!(mgr.version().to_string(), "1.30.1"); // newest-version-marker — DO NOT REMOVE; auto-updated by `just update-cli-scanner`
     }
 
     #[tokio::test]
@@ -237,7 +237,7 @@ mod tests {
                 .await
                 .unwrap()
                 .to_string(),
-            "1.23.0"
+            mgr.version().to_string()
         );
     }
 
@@ -260,7 +260,7 @@ mod tests {
                 .await
                 .unwrap()
                 .to_string(),
-            "1.23.0"
+            mgr.version().to_string()
         );
     }
 }

src/infra/sysdig_image_scanner_json_scan_result_v1.rs

@@ -372,6 +372,10 @@ pub(super) enum JsonPackageType {
     Ruby,
     #[serde(rename = "rust")]
     Rust,
+    #[serde(rename = "oci")]
+    Oci,
+    #[serde(rename = "Software Runtime")]
+    SoftwareRuntime,
     #[default]
     Unknown,
 }
@@ -388,6 +392,8 @@ impl From<JsonPackageType> for PackageType {
             JsonPackageType::Python => Self::Python,
             JsonPackageType::Ruby => Self::Ruby,
             JsonPackageType::Rust => Self::Rust,
+            JsonPackageType::Oci => Self::Oci,
+            JsonPackageType::SoftwareRuntime => Self::SoftwareRuntime,
             JsonPackageType::Unknown => Self::Unknown,
         }
     }
@@ -571,8 +577,10 @@ pub(super) struct JsonVulnerability {
 #[cfg(test)]
 mod tests {
     use crate::{
-        domain::scanresult::{scan_result::ScanResult, severity::Severity},
-        infra::sysdig_image_scanner_json_scan_result_v1::JsonScanResultV1,
+        domain::scanresult::{
+            package_type::PackageType, scan_result::ScanResult, severity::Severity,
+        },
+        infra::sysdig_image_scanner_json_scan_result_v1::{JsonPackageType, JsonScanResultV1},
     };
 
     #[test]
@@ -672,4 +680,15 @@ mod tests {
         assert!(found_layer.is_some(), "Should find layer by valid digest");
         assert_eq!(found_layer.unwrap().digest(), Some(digest));
     }
+
+    #[rstest::rstest]
+    #[case(r#""oci""#, PackageType::Oci)]
+    #[case(r#""Software Runtime""#, PackageType::SoftwareRuntime)]
+    fn it_deserializes_package_types_added_in_newer_scanners(
+        #[case] json: &str,
+        #[case] expected: PackageType,
+    ) {
+        let package_type: JsonPackageType = serde_json::from_str(json).unwrap();
+        assert_eq!(PackageType::from(package_type), expected);
+    }
 }