Skip to content

ci(deps): update Nextcloud base images with Renovate - #82

Merged
vitormattos merged 9 commits into
mainfrom
security/php-rce-fixes-2026-10-21
Oct 22, 2026
Merged

ci(deps): update Nextcloud base images with Renovate#82
vitormattos merged 9 commits into
mainfrom
security/php-rce-fixes-2026-10-21

Conversation

@vitormattos

@vitormattos vitormattos commented Oct 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

  • Pin supported Nextcloud base images by tag and digest in the existing version manifest.
  • Configure Renovate to propose image updates; keep support/EOL changes in the existing discovery workflow.
  • Use Dependabot for the Nginx base and remove the custom rebuild checker and scheduled builds.

Validation

  • 23 Bats tests passed; ShellCheck, Actionlint, and Renovate configuration validation passed.
  • CI is pending. Verify Renovate has access to this repository before merging.

Images are published through the existing workflow after a reviewed PR is merged.

@vitormattos
fix(security): require PHP patched for critical RCEs
af7416c 
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
@vitormattos
fix(ci): pull patched Nextcloud base images before validation
17cb25a 
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
@vitormattos
refactor(security): validate PHP from upstream releases, not static C…
eca3dda 
…VE ranges

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
@vitormattos vitormattos changed the title fix(security): Prevent distribution of unpatched Nextcloud PHP images fix(security): verify PHP runtime against upstream releases before publishing Oct 21, 2026
@vitormattos
feat(ci): monitor upstream image digests and rebuild on security updates
cad2710 
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
@vitormattos vitormattos changed the title fix(security): verify PHP runtime against upstream releases before publishing feat(security): detect upstream PHP fixes and rebuild Nextcloud images automatically Oct 21, 2026
@vitormattos
refactor(ci): use Dependabot-managed Nextcloud base image digests
b57976e 
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
@vitormattos vitormattos changed the title feat(security): detect upstream PHP fixes and rebuild Nextcloud images automatically refactor(ci): track pinned Nextcloud base images with Dependabot Oct 21, 2026
@vitormattos
refactor(ci): rebuild maintained images daily with fresh bases
815f3a0 
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
@vitormattos vitormattos changed the title refactor(ci): track pinned Nextcloud base images with Dependabot ci: rebuild maintained Docker images daily with refreshed bases Oct 21, 2026
@vitormattos
feat(ci): skip unchanged upstream images before scheduled builds
b2db507 
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
@vitormattos vitormattos changed the title ci: rebuild maintained Docker images daily with refreshed bases ci: rebuild Nextcloud images only when upstream changes, with weekly refresh Oct 21, 2026
@vitormattos
refactor(ci): update pinned Nextcloud images through Renovate
018bafb 
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
@vitormattos vitormattos changed the title ci: rebuild Nextcloud images only when upstream changes, with weekly refresh ci(deps): manter bases Nextcloud atualizadas com Renovate Oct 21, 2026
@vitormattos
fix(ci): use complete Nginx image digest
1f2d8c3 
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
@vitormattos vitormattos changed the title ci(deps): manter bases Nextcloud atualizadas com Renovate ci(deps): update Nextcloud base images with Renovate Oct 22, 2026
@vitormattos
vitormattos merged commit 22ca80c into main Oct 22, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vitormattos