ci: scan release images with the official CrowdStrike fcs-action

[paco-ravenpack]

Summary

The v3.0.0 release build failed with an opaque exit code 6 before the image was pushed to GHCR, so Fly Deploy never ran (run).

The Docker build itself succeeded. The failure was in Bigdata-com/security-scan-containers@master, which downloads a pinned FCS CLI:

curl --silent --location --output ${FCS_FILENAME} ${FCS_CLI_LINK}

CrowdStrike no longer serves fcs_2.0.2_Linux_x86_64.tar.gz from the downloads endpoint (the CLI is on 2.3.x/4.x now). The API returns no download_url, jq -r yields the string null, and curl fails trying to resolve a host named null. Nothing in the log says so, because the script never checks that the link is usable.

Changes:

• Replace the shared action with the official crowdstrike/fcs-action@v5.0.2, which resolves the current CLI itself instead of pinning a version that gets retired. The policy result comes back through its exit-code output, and a follow-up step fails the job on a non-zero value, preserving the previous gating behaviour.
• Add load: true to the build step. With push: false and no load, the image stays in the buildx cache and never reaches the Docker daemon, so the scan was pulling :latest from GHCR — the previous release's image — rather than the one just built.

Note: bigdata-briefs and bigdata-thematic-screener pin fcs_version: "2.0.2" too, and the shared action defaults to it. Neither has released since November 2025, so their next release will fail the same way.

Test plan

• Merge, then recreate the v3.0.0 release to re-fire release: published
• Confirm the security scan step downloads the CLI and completes
• Confirm ghcr.io/bigdata-com/bigdata-risk-analyzer:v3.0.0 and :latest are pushed
• Confirm Fly Deploy runs afterwards

Made with Cursor

[fricigliano]

LGTM