Cut a GitHub release from the rebuild, and pin the release workflow (#101)

Yesterday's rebuild cleared CVE-2026-14456 and published 2026.9.0, and the scan
refiled that same CVE this morning (BEE-1172, BEE-1173). It never looked at the
rebuilt image: secops resolves this product from our last two GitHub *releases*
(localstack/secops, localstack_products.json: type=github,
github_releases_fetch_limit=2), looking each release's tag_name up verbatim on
Docker Hub. We pushed a bare git tag and no release, so the scan window stayed on
v2026.8.0 -- and Docker Hub had no v2026.9.0 tag for it to resolve either, since
the publish step minted only the bare version.

So: publish v${NEW} alongside ${NEW}, and cut the release. Also move latest, which
nothing in the scan reads but `docker pull` and the marketplace do -- it still
points at the superseded 2026.8.0. type=sha stays dropped: the candidate is built
from the commit before the version bump.

This does not stop a *new* Alpine CVE being ticketed. localstack_products.json
still has docker-desktop as rebuild_model=on-release, so classify_findings.py
rule 3 tickets OS-layer findings instead of leaving them to the rebuild; that
entry wants flipping to scheduled now that this workflow exists.

Also SHA-pin build-push-docker.yml's five actions, at the versions Dependabot
proposes in #100 -- that file has always used floating tags, and it is the one
holding the Docker Hub credentials. Both tags already ship provenance
attestations, so the major bumps do not change the published index shape.

Author: carole-lavillonniere

.github/workflows/build-push-docker.yml

@@ -20,23 +20,23 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Download binaries
         run: bash downloadBinaries.sh
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: localstack/localstack-docker-desktop
           tags: |
@@ -46,7 +46,7 @@ jobs:
             type=sha
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: "./Dockerfile"

.github/workflows/security-rebuild.yml

@@ -147,23 +147,33 @@ jobs:
 
       - name: Publish (multi-arch)
         # Published here rather than via build-push-docker.yml: GITHUB_TOKEN pushes don't trigger workflows.
+        # v${NEW} is what the secops scan resolves; latest is what docker pull and the marketplace read.
         if: steps.delta.outputs.cleared == 'true' && !inputs.dry_run
         env:
           NEW: ${{ steps.bump.outputs.version }}
         run: |
-          echo "Publishing ${PUBLISHED_IMAGE}:${NEW}, clearing:"; cat cleared.txt
+          echo "Publishing ${PUBLISHED_IMAGE}:${NEW} (also v${NEW}, latest), clearing:"; cat cleared.txt
           docker buildx build --push --pull --no-cache \
             --platform "${PLATFORMS}" \
-            --tag "${PUBLISHED_IMAGE}:${NEW}" .
+            --tag "${PUBLISHED_IMAGE}:${NEW}" \
+            --tag "${PUBLISHED_IMAGE}:v${NEW}" \
+            --tag "${PUBLISHED_IMAGE}:latest" .
 
       # After the publish on purpose: a failed publish must not leave TAG pointing at an unpushed image.
-      - name: Commit and tag
+      - name: Commit, tag and release
         if: steps.delta.outputs.cleared == 'true' && !inputs.dry_run
+        env:
+          NEW: ${{ steps.bump.outputs.version }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           git add Makefile Dockerfile CHANGELOG.md
-          git commit -m "Security rebuild ${{ steps.bump.outputs.version }}"
-          git tag "v${{ steps.bump.outputs.version }}"
-          git push origin HEAD:main "v${{ steps.bump.outputs.version }}"
+          git commit -m "Security rebuild ${NEW}"
+          git tag "v${NEW}"
+          git push origin HEAD:main "v${NEW}"
+
+          # The secops scan reads our GitHub releases, not our tags; a bare tag leaves it on the old version.
+          gh release create "v${NEW}" --title "${NEW}" \
+            --notes "Weekly security rebuild (COSY-926). Cleared: $(paste -sd', ' cleared.txt)."
 
       - name: Summary
         if: always()