Extract the release build/push and manifest jobs into a reusable
build-images.yml workflow, extend it with a distroless variant, and add
a weekly rebuild-images.yml so digest-pinned bases pick up security
updates without a manual re-pin.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Deleting uv, pip and setuptools in a runtime RUN removed them from the
final filesystem but not from the image: the COPY layer that carried
them is still shipped. The analyzer's /usr/local/bin layer measured
48.9MB while the directory itself is 148KB in the final image.
Stage uv in /usr/bin, outside the /usr/local tree the runtime stage
copies from, and strip packaging tooling in the builder before the copy.
The runtime removal stays, because it also has to clear the copies that
ship in the runtime base image.
anonymizer 332MB -> 252MB, analyzer 1.59GB -> 1.50GB. Both are now
smaller than the currently published images (355MB / 1.53GB). CVE counts
are unchanged at 111, health checks pass, the encrypt/decrypt round-trip
returns the original text and the analyzer still detects PERSON,
EMAIL_ADDRESS, PHONE_NUMBER and CREDIT_CARD.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
