fix(ci): keep Docker PHP runtimes on their supported version lines

.docker/Dockerfile.php82

@@ -1,5 +1,8 @@
 FROM php:8.2.35-fpm@sha256:a58479410c94b3f0f7dfacc27fba8befc122290743fd0eb8c88a99ff2a0b1ba1
 
+# Fail closed if a dependency update changes the PHP minor runtime.
+RUN test "$(php -r 'echo PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION;')" = "8.2"
+
 
 
 RUN apt-get update \

.docker/Dockerfile.php83

@@ -1,5 +1,8 @@
 FROM php:8.3.36-fpm@sha256:d0dea3f5d95314eac94a732469f4cf0ee658a22c2ce3f2612272b9d5b42d1a72
 
+# Fail closed if a dependency update changes the PHP minor runtime.
+RUN test "$(php -r 'echo PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION;')" = "8.3"
+
 
 
 RUN apt-get update \

.github/dependabot.yml

@@ -9,6 +9,12 @@ updates:
     directory: "/.docker/"
     schedule:
       interval: "daily"
+    # Each Dockerfile targets a fixed PHP minor version; update patches only.
+    ignore:
+      - dependency-name: "php"
+        update-types:
+          - "version-update:semver-minor"
+          - "version-update:semver-major"
 
   - package-ecosystem: "docker-compose"
     directories:

.github/workflows/docker-php.yml

@@ -58,6 +58,19 @@ jobs:
           NAME="${{ matrix.container }}"
           DOCKERFILE=$([[ -f ".docker/$NAME/Dockerfile" ]] && echo ".docker/$NAME/Dockerfile" || echo ".docker/Dockerfile.$NAME")
           echo "DOCKERFILE=$DOCKERFILE" >> $GITHUB_OUTPUT
+      - name: Verify Dockerfile PHP version
+        env:
+          DOCKERFILE: ${{ steps.dockerfile.outputs.DOCKERFILE }}
+          PHP_VERSION: ${{ matrix.version }}
+        shell: bash
+        run: |
+          major="${PHP_VERSION%%.*}"
+          minor="${PHP_VERSION#*.}"
+          from="$(grep -m 1 -E '^FROM[[:space:]]+' "$DOCKERFILE")"
+          if [[ ! "$from" =~ ^FROM[[:space:]]+php:${major}[.]${minor}[.][0-9]+-fpm@sha256:[0-9a-f]{64}$ ]]; then
+            echo "::error file=$DOCKERFILE::Expected pinned PHP $PHP_VERSION patch image and sha256 digest; found: $from"
+            exit 1
+          fi
       - name: Build container image
         uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:

docs/advanced-setup.md

@@ -12,6 +12,16 @@ VERSION_NEXTCLOUD=stable33 docker compose up
 
 By default, `VERSION_NEXTCLOUD` uses `master`. To use another Nextcloud version, set it to the corresponding branch from the [Nextcloud server repository](https://github.com/nextcloud/server).
 
+### PHP versions
+
+PHP 8.3 (`PHP_VERSION=83`) is the default, and PHP 8.2 (`PHP_VERSION=82`)
+remains available for compatibility. PHP 8.1 is no longer supported or built;
+its Dockerfile is retained in Git history only.
+
+Base images are pinned to a PHP patch version and OCI digest. Dependabot can
+update patches and digests within each supported PHP minor series. A new PHP
+minor version requires an explicit Dockerfile and publishing-matrix change.
+
 Xdebug can be configured with its native `XDEBUG_MODE` variable:
 
 ```bash