Publish latest and v* from the rebuild, and pin the release workflow

The rebuild published only IMAGE:$NEW, so latest stayed on 2026.8.0 while the
fix shipped as 2026.9.0. Normally the v* git tag reaches build-push-docker.yml,
whose metadata-action mints $NEW, v$NEW, sha-* and moves latest (latest=auto) --
but the bot pushes that tag with GITHUB_TOKEN, which does not trigger workflows.
The secops scanner and `docker extension install` both read latest, so it refiled
CVE-2026-14456 (BEE-1172, BEE-1173) against the image we had already fixed.

Mint the same tag set here instead. type=sha is left out: the candidate is built
from the commit before the version bump, so sha-* would point at the wrong tree.

Also SHA-pin build-push-docker.yml's five actions, at the versions Dependabot
proposes in #100 -- that file has always used floating tags, and it is the one
holding the Docker Hub credentials. Both tags already ship provenance
attestations, so the major bumps do not change the published index shape.

Author: carole-lavillonniere

.github/workflows/build-push-docker.yml

@@ -20,23 +20,23 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Download binaries
         run: bash downloadBinaries.sh
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: localstack/localstack-docker-desktop
           tags: |
@@ -46,7 +46,7 @@ jobs:
             type=sha
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: "./Dockerfile"

.github/workflows/security-rebuild.yml

@@ -146,15 +146,21 @@ jobs:
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Publish (multi-arch)
-        # Published here rather than via build-push-docker.yml: GITHUB_TOKEN pushes don't trigger workflows.
+        # Published here rather than via build-push-docker.yml: GITHUB_TOKEN pushes don't trigger workflows,
+        # so the v* tag pushed below never reaches it. That means we have to mint the same tag set it would
+        # have: metadata-action's latest=auto moves latest on a semver tag, and the secops scanner and every
+        # `docker extension install` read latest — leave it behind and the CVE gets refiled against the old
+        # image even though the fix shipped. Only type=sha is dropped: the build predates the version commit.
         if: steps.delta.outputs.cleared == 'true' && !inputs.dry_run
         env:
           NEW: ${{ steps.bump.outputs.version }}
         run: |
-          echo "Publishing ${PUBLISHED_IMAGE}:${NEW}, clearing:"; cat cleared.txt
+          echo "Publishing ${PUBLISHED_IMAGE}:${NEW} (also v${NEW}, latest), clearing:"; cat cleared.txt
           docker buildx build --push --pull --no-cache \
             --platform "${PLATFORMS}" \
-            --tag "${PUBLISHED_IMAGE}:${NEW}" .
+            --tag "${PUBLISHED_IMAGE}:${NEW}" \
+            --tag "${PUBLISHED_IMAGE}:v${NEW}" \
+            --tag "${PUBLISHED_IMAGE}:latest" .
 
       # After the publish on purpose: a failed publish must not leave TAG pointing at an unpushed image.
       - name: Commit and tag