fix(ci): use apollo-ci image for generate-db-dump

[BradLugo]

#3303 introduced a bug where generate-db-dump will error in the following manner:

Run source ./scripts/ci/lib.sh
  source ./scripts/ci/lib.sh
  generate_db_dump
  shell: /usr/bin/bash -e {0}
INFO: Wed Jul  1 01:17:14 UTC 2026: Generating DB dump
groupadd: GID '1001' already exists

Example: https://github.com/stackrox/scanner/actions/runs/28485288342/job/84434649671

Additionally, since the updater build job uses an image that won't be in sync with dependent jobs, we may run into issues with the dynamically linked libraries available in the image. Example of when this will cause a problem: https://github.com/stackrox/scanner/actions/runs/28487169799/job/84440317595?pr=3348

These changes add the apollo-ci image back to the generate-db-dump job and set CGO_ENABLED=0 during the updater build to ensure the updater can run properly.

[coderabbitai]

📝 Walkthrough

Walkthrough

The CI workflow now disables CGO for the amd64 updater build step and runs the generate-db-dump job inside the quay.io/stackrox-io/apollo-ci:scanner-test-0.4.9 container.

Changes

CI Workflow Update

Layer / File(s)	Summary
Adjust updater build environment .github/workflows/ci.yaml	Changes the amd64 updater build command to CGO_ENABLED=0 make build-updater and adds comments about the build variance.
Add container image to generate-db-dump job .github/workflows/ci.yaml	Adds a container.image block specifying quay.io/stackrox-io/apollo-ci:scanner-test-0.4.9 for the generate-db-dump job.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: restoring the apollo-ci image for generate-db-dump.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The description matches the workflow fixes for generate-db-dump and the updater build.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch blugo/fix-generate-db-dump

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[BradLugo]

/test slim-e2e-tests

[openshift-ci]

@BradLugo: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/slim-e2e-tests	8291ec6	link	false	/test slim-e2e-tests
ci/prow/e2e-tests	8291ec6	link	false	/test e2e-tests

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.