[YvesCesar]

Summary

The PHP images run two installers downloaded at build time without any verification: install-php-extensions from the latest release and the nvm installer from the master branch, piped into bash. The nginx image was built from the floating nginx:alpine tag and is republished every night. A change upstream would end up in the published :latest images without any review in this repository.

This change:

• Downloads install-php-extensions 2.13.2 and the nvm v0.41.0 installer with ADD --checksum, so the build fails if the content differs from the pinned SHA-256. The nvm installer is no longer piped into a shell.
• Pins the nginx base image to nginx:1.31.8-alpine by digest, which Dependabot already tracks under /.docker/.
• Adds a policy test that rejects floating references for these downloads.

Validation

• New test in tests/proxy/compose-policy.bats fails on main and passes with this change; the rest of the file still passes.
• Built Dockerfile.php83 and Dockerfile.nginx locally: the PHP image installs the same 59 PHP modules and Node 24 with npm and nvm 0.41.0, and the installers are not left in the image.
• A build with a wrong checksum fails with a digest mismatch.

[vitormattos]

Please make both dependencies automatically maintainable in Dockerfile.php82 and Dockerfile.php83:

1. PHP Extension Installer: Keep the existing ADD --checksum. Configure Renovate custom.regex with datasource github-release-attachments (mlocati/docker-php-extension-installer), extracting currentValue from the release URL and currentDigest from the SHA-256. Both must be updated together.

2. NVM: Replace the remote installer with a Git checkout of the immutable commit, before sourcing nvm.sh. Declare the version and commit on separate lines:

   # v0.41.0
   ARG NVM_COMMIT=4e8758a801eea9479b32a904f31093e410ddaba4
   

   Configure a second Renovate custom.regex using github-tags (nvm-sh/nvm), mapping the version comment to currentValue and the commit SHA to currentDigest. Both must update together.

Add .github/renovate.json5 with enabledManagers: ["custom.regex"], limited to these two dependencies. Keep Dependabot responsible for the existing PHP and Nginx image updates.

Update the Bats policy test and validate Renovate extraction/update plus both PHP image builds.