Secret Scan / scan (push) Successful in 4s
Build App (Preview) / compute-version (pull_request) Successful in 5s
Build STT Container / build-stt-container (pull_request) Failing after 4m10s
Secret Scan / scan (pull_request) Successful in 5s
Build App (Preview) / create-release (pull_request) Successful in 2s
Build App (Preview) / test (pull_request) Successful in 5m51s
Build App (Preview) / build-macos (pull_request) Successful in 3m17s
Build App (Preview) / build-windows (pull_request) Successful in 6m42s
Build App (Preview) / build-linux (pull_request) Failing after 9m8s
Build App (Preview) / prune-previews (pull_request) Skipped
Build Container / build-container (pull_request) Successful in 22m17s
CI builds with cache-from: type=gha, so the apt-get upgrade layer was reused until the base digest or the layer text changed, and security fixes published since then never reached the image. The RUN now uses an APT_REFRESH build arg, which build.yml sets to the ISO week, and a weekly schedule trigger rebuilds without a commit. Publishing is gated on event_name != 'pull_request' so the scheduled run (always on main) publishes and PR runs still only validate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>