[ccf-lisa]

Bumps the shared workflows from v1.7.0 to v1.9.2. CI gains a non-gating image job that builds the api image for amd64 and fails on any fixable HIGH/CRITICAL vulnerability; it sits outside ci / required, so it never blocks a merge.
The default images list already matches what release.yml publishes, so ci.yml needs no new input. v1.9.1 fixed the golangci-lint config verify step, which no longer passes --schema (workflows#166). AGENTS.md and the Makefile match the golangci-lint v2.15.0 that v1.9.2 still runs.

v1.9.2 (dc7434879fbd0db1d1df9f590ed8bc13789bd320) adds on top of v1.9.1: ccf-bump lets go switch toolchains and keeps the toolchain line and golang images in step (workflows#168); the Renovate preset lets Docker tag updates through, takes Go stdlib fixes via the toolchain line, and a CI guard checks it (workflows#169); and image-scan rates Go findings by their Bitnami CVSS when the Go record has none (workflows#170).

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: ed47159a-6932-4895-9793-e88def465b38

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gusfcarvalho]

would REQUEST_CHANGES (posted as COMMENT: the maintainer approves or blocks these PRs themselves)

ccf-review: would REQUEST_CHANGES

1 Blocker, 1 Should-fix.

Outside the diff

• [Should-fix] AGENTS.md:34 CORE-DOC-001: AGENTS.md says the commands under Commands "are what CI runs" and documents make lint as golangci-lint v2.11.4 (make lint.install); Makefile:136 installs v2.11.4. With this bump CI lints with golangci-lint v2.15.0, so local make lint and CI can disagree. (84783bf77f91)

Checked

• All 7 shared-workflow refs (ci, release-checks, notify, cut-prerelease, preview, release-please, release) now pin 1e188815a0e8036da1bea4e637a9973ecdc3ae1c, the commit the v1.9.0 tag points to; nothing references v1.7.0 / e85d35af any more.
• release.yml's image list (api, Dockerfile, .) equals the new images default [{}] (repo name, Dockerfile, .), so ci.yml needs no images input.
• No caller permission change is needed: ci-image.yml at v1.9.0 has top-level permissions: {} and contents: read on its job, which jobs.ci already grants; notify-failure's new image-incident steps only use the Actions cache.

Note (not a finding): ci / image / image (api) fails on this PR with 5 fixable libssl3 findings (1 CRITICAL, 4 HIGH; fixed in 3.0.22-1~deb12u1/u2) from the Debian base. It sits outside ci / required as designed, but once merged every push to main will be red on image (with its own Slack incident) until the base image picks up the fix.

[gusfcarvalho]

Approved: workflows v1.9.2 pins; required is green (image-check failures are the known CVE findings Renovate will fix).