Rebuild of stable images to pick up base-image security fixes #146

Problem

Stable images (7.2, 8.0, 8.1, 9.0, -alpine and -debian) are only rebuilt when versions.json changes or someone manually dispatches a build. Since packages like zlib and OpenSSL comes from the base image, a base security fix only reaches our images on a rebuild, so a stable image can carry a known-vulnerable package until a maintainer notices.

ci.yml's daily cron rebuilds unstable only but stable versions get no automatic rebuild.

Precedent: this has already happened before. Once the request to rebuild was issued over valkey slack here by Ziyan Zhu and @stockholmux, then #117 (openssl CVE-2025-15467) was fixed by rebuilding on the patched Alpine base (#120), and #136 (zlib CVE-2026-27171) is the same pattern base fix available, only a rebuild needed. Both were handled manually, an automated scan-and-rebuild closes that gap.

Proposed solution: Agent-driven CVE scan using valkey-ci-agent + human approved rebuild

Rebuild only when a base-package CVE exists that a rebuild would actually fix, with a maintainer in the loop:

1. Weekly scan: scan published images with Trivy/Grype.
2. Decide: for each base-package CVE, check whether the current base already ships the fix -> rebuild-fixable (the zlib / CVE-2026-27171 case).
3. Open issue: bot files a rebuild-request issue listing affected images, CVEs, and rationale (non-fixable CVEs get a separate triage issue opening).
4. Approve: an authorized maintainer comments /rebuild <image>; the bot checks authorization (author_association / team).
5. Dispatch: bot triggers ci.yml via workflow_dispatch, posts the run link, and closes the issue with new digests on success.

Notes: runs entirely in GitHub Actions (no backend); bot acts as the Valkeyrie Bot App via a scoped in-workflow token (actions/create-github-app-token, per valkey-release-automation PR #56; needs actions: write); approve->dispatch is deterministic and authorization-gated, AI is advisory.

Why: targeted (no digest churn when nothing changed), auditable (every rebuild has an issue + approver), human-in-the-loop.

Alternative considered

• Weekly cron rebuilding all images - simplest, but churns digests on a fixed cadence regardless of whether a CVE exists, with no record of why

Scope / acceptance criteria

• Weekly CVE-scan workflow (Trivy/Grype) over the image matrix
• Rebuild-fixability classification
• Open rebuild-request / triage issues
• issue_comment listener with authorization gating
• Dispatch ci.yml via the Valkeyrie Bot App token on approval