Delete the legacy rebuild workflows and their vestigial version-bump script

CLAUDE.md

@@ -48,11 +48,14 @@ shellcheck simplerisk/entrypoint.sh simplerisk-minimal/entrypoint.sh
 make update_version VERSION=YYYYMMDD-NNN
 ```
 
-This runs four scripts in sequence:
-1. `update_workflows.sh` — patches version in push workflow files
-2. `simplerisk/generate_dockerfile.sh` — regenerates the full-stack Dockerfile from a template
-3. `simplerisk-minimal/update_stack_and_workflows.sh` — regenerates `stack.yml` (with a fresh random password) and updates workflow files
-4. `simplerisk-minimal/generate_dockerfile.sh` — regenerates the minimal Dockerfile
+This runs three scripts in sequence:
+1. `simplerisk/generate_dockerfile.sh` — regenerates the full-stack Dockerfile from a template
+2. `simplerisk-minimal/update_stack_and_workflows.sh` — regenerates `stack.yml`
+3. `simplerisk-minimal/generate_dockerfile.sh` — regenerates the minimal Dockerfile
+
+The version now lives only in the two generated Dockerfiles (`ENV version=`), which is
+where `promote-latest.yml` and `create_new_tag.yml` read it from. No workflow carries a
+version pin any more.
 
 ### Nix dev environment
 
@@ -119,7 +122,6 @@ The entrypoint script handles:
 - **PRs** trigger `container-validation.yml`: builds all 4 variants (jammy, noble, php81, php83), runs Dockle (Dockerfile linter) and Grype (CVE scanner, severity cutoff: critical, only-fixed).
 - **Release images are built once, then promoted — never rebuilt.** A push to `testing` runs `publish-testing.yml`, which builds both images from the current testing bundle and publishes immutable tags: `simplerisk-minimal` gets `<VERSION>-php83/-php84/-php85` (multi-arch `linux/amd64,linux/arm64`) and `simplerisk` gets `<VERSION>-jammy/-noble` (amd64). Each image's default variant also takes the bare `<VERSION>` and the floating `:testing`.
 - **GA is a manual promote, not a build.** After the release merges to `master`, dispatch `promote-latest.yml`. It retags Docker Hub `:latest` to the existing RC digest (`buildx imagetools create`, multi-arch preserved), mirrors the same digests to GHCR cosign-signed, and writes SSM `/simplerisk/customers/image-tag/latest`. Nothing is rebuilt, so the bytes validated in testing are the bytes that ship. A currency guard refuses to promote a version whose digest is not the one `:testing` currently points at.
-- `push-to-dockerhub.yml` / `push-to-gh-pkgs.yml` are **legacy rebuild workflows, manual dispatch only** — they no longer run on a `master` push. See their headers; they are deletable once the first post-cutover RC has published full-stack RC digests.
 - The reusable workflow files (`*_rw.yml`) are called by the entry-point workflows.
 
 ### Vulnerability ignore list

Makefile

@@ -37,7 +37,6 @@ help:
 	@echo -e "$$HELP_MESSAGE"
 
 update_version: 
-	./update_workflows.sh $(VERSION)
 	./simplerisk/generate_dockerfile.sh $(VERSION)
 	./simplerisk-minimal/update_stack_and_workflows.sh $(VERSION)
 	./simplerisk-minimal/generate_dockerfile.sh $(VERSION)

gorin.toml

@@ -10,8 +10,7 @@ check_dependencies
 [options.update_version]
 description = "Updates the version of Dockerfiles, stacks and others"
 command = """
-\n\t./update_workflows.sh $(VERSION)
-\t./simplerisk/generate_dockerfile.sh $(VERSION)
+\n\t./simplerisk/generate_dockerfile.sh $(VERSION)
 \t./simplerisk-minimal/update_stack_and_workflows.sh $(VERSION)
 \t./simplerisk-minimal/generate_dockerfile.sh $(VERSION)
 """