Run the security rebuild daily (#112)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: carole-lavillonniere

.github/workflows/security-rebuild.yml

@@ -1,10 +1,10 @@
-name: Weekly Security Rebuild
+name: Daily Security Rebuild
 
-# Rebuild weekly to pick up Go toolchain and OS patches, republishing only when it clears a CVE (COSY-926).
+# Rebuild daily to pick up Go toolchain and OS patches, republishing only when it clears a CVE (COSY-926).
 
 on:
   schedule:
-    - cron: "0 8 * * TUE"
+    - cron: "0 8 * * *"
   workflow_dispatch:
     inputs:
       dry_run:
@@ -115,7 +115,7 @@ jobs:
           fi
 
       - name: Report CVEs a rebuild cannot fix
-        # Surface these instead of no-op'ing weekly until the SLA on the secops ticket burns.
+        # Surface these instead of no-op'ing daily until the SLA on the secops ticket burns.
         if: steps.before.outputs.proceed == 'true' && steps.delta.outputs.cleared == 'false'
         run: |
           echo "::warning::Rebuild cleared nothing; these need a dependency bump: $(paste -sd', ' published_cves.txt)"
@@ -170,13 +170,13 @@ jobs:
 
           # The secops scan reads our GitHub releases, not our tags; a bare tag leaves it on the old version.
           gh release create "v${NEW}" --title "${NEW}" \
-            --notes "Weekly security rebuild (COSY-926). Cleared: $(paste -sd', ' cleared.txt)."
+            --notes "Daily security rebuild (COSY-926). Cleared: $(paste -sd', ' cleared.txt)."
 
       - name: Summary
         if: always()
         run: |
           {
-            echo "### Weekly security rebuild"
+            echo "### Daily security rebuild"
             echo
             echo "- Published image: \`${PUBLISHED_IMAGE}:${{ steps.version.outputs.tag }}\`"
             echo "- Fixable CVEs on the published image: $(wc -l < published_cves.txt 2>/dev/null || echo 0)"

README.md

@@ -62,7 +62,7 @@ Most CVEs reported against this image come from the Go toolchain compiled into
 the `service` binary rather than from any dependency manifest, so they are fixed
 by rebuilding on a newer `golang:1.26-alpine` rather than by bumping anything.
 
-The [weekly security rebuild](.github/workflows/security-rebuild.yml) does this
+The [daily security rebuild](.github/workflows/security-rebuild.yml) does this
 automatically: it scans the published image, rebuilds from scratch, and
 republishes a new patch version **only if the rebuild actually clears a CVE**.
 Rebuilds that change nothing are not released, so no update badge appears in
@@ -75,7 +75,7 @@ same workflow via `workflow_dispatch`.
 Every PR builds the image and runs the smoke test via
 [PR CI](.github/workflows/pr.yml), so a bump is verified on its own branch
 before it lands. Testing before the merge matters here: if you test afterwards,
-the next weekly rebuild sees the CVE count drop and releases the bump without
+the next daily rebuild sees the CVE count drop and releases the bump without
 the test ever having run.
 
 ### Validating a CVE fix locally