From 963a0e6535696e25e97f045ffafaa822e9e08093 Mon Sep 17 00:00:00 2001
From: carole-lavillonniere <carole.lavillonniere@gmail.com>
Date: Wed, 21 Oct 2026 13:45:26 +0200
Subject: [PATCH 1/3] Rebuild on a fixable CVE of any severity

---
 .github/workflows/security-rebuild.yml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/security-rebuild.yml b/.github/workflows/security-rebuild.yml
index 80beef7..aa76878 100644
--- a/.github/workflows/security-rebuild.yml
+++ b/.github/workflows/security-rebuild.yml
@@ -55,7 +55,6 @@ jobs:
         with:
           image-ref: ${{ env.PUBLISHED_IMAGE }}:${{ steps.version.outputs.tag }}
           scanners: vuln
-          severity: HIGH,CRITICAL
           ignore-unfixed: true
           format: json
           output: published.json
@@ -64,7 +63,7 @@ jobs:
         id: before
         run: |
           jq -r '[.Results[]?.Vulnerabilities[]?.VulnerabilityID] | unique | .[]' published.json | sort -u > published_cves.txt
-          echo "Fixable HIGH/CRITICAL CVEs on the published image:"; cat published_cves.txt || true
+          echo "Fixable CVEs on the published image:"; cat published_cves.txt || true
           if [ -s published_cves.txt ]; then
             echo "proceed=true" >> "$GITHUB_OUTPUT"
           else
@@ -92,7 +91,6 @@ jobs:
         with:
           image-ref: localstack-docker-desktop:candidate
           scanners: vuln
-          severity: HIGH,CRITICAL
           ignore-unfixed: true
           format: json
           output: candidate.json
@@ -182,7 +180,7 @@ jobs:
             echo "### Weekly security rebuild"
             echo
             echo "- Published image: \`${PUBLISHED_IMAGE}:${{ steps.version.outputs.tag }}\`"
-            echo "- Fixable HIGH/CRITICAL on the published image: $(wc -l < published_cves.txt 2>/dev/null || echo 0)"
+            echo "- Fixable CVEs on the published image: $(wc -l < published_cves.txt 2>/dev/null || echo 0)"
             echo "- Cleared by rebuild: $(wc -l < cleared.txt 2>/dev/null || echo 0)"
             echo "- Released: ${{ steps.bump.outputs.version || 'no (nothing cleared)' }}"
           } >> "$GITHUB_STEP_SUMMARY"

From f80b7862f6297f4791aef604daffb184fdd635da Mon Sep 17 00:00:00 2001
From: carole-lavillonniere <carole.lavillonniere@gmail.com>
Date: Wed, 21 Oct 2026 13:51:43 +0200
Subject: [PATCH 2/3] Say why the rebuild runs on Tuesdays now that secops
 scans daily

---
 .github/workflows/security-rebuild.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/security-rebuild.yml b/.github/workflows/security-rebuild.yml
index aa76878..2b740d1 100644
--- a/.github/workflows/security-rebuild.yml
+++ b/.github/workflows/security-rebuild.yml
@@ -4,7 +4,7 @@ name: Weekly Security Rebuild
 
 on:
   schedule:
-    # ~22h ahead of the secops Wednesday 06:00 UTC scan, so anything cleared here is never filed.
+    # Ahead of the Wednesday 06:00 UTC secops scan, the one the weekly customer report is built from.
     - cron: "0 8 * * TUE"
   workflow_dispatch:
     inputs:

From 47f3d90d577c6bda848174e06b09ff76eca08fbe Mon Sep 17 00:00:00 2001
From: carole-lavillonniere <carole.lavillonniere@gmail.com>
Date: Wed, 21 Oct 2026 14:03:16 +0200
Subject: [PATCH 3/3] Drop the cron comment

---
 .github/workflows/security-rebuild.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/security-rebuild.yml b/.github/workflows/security-rebuild.yml
index 2b740d1..8f2b6f1 100644
--- a/.github/workflows/security-rebuild.yml
+++ b/.github/workflows/security-rebuild.yml
@@ -4,7 +4,6 @@ name: Weekly Security Rebuild
 
 on:
   schedule:
-    # Ahead of the Wednesday 06:00 UTC secops scan, the one the weekly customer report is built from.
     - cron: "0 8 * * TUE"
   workflow_dispatch:
     inputs: