[YvesCesar]

Several inputs of the image and the stack were resolved at build or start time without a fixed version or a checksum: install-php-extensions came from releases/latest and ran as root, wp-cli.phar was downloaded from the gh-pages branch with a curl that did not fail on HTTP errors and was never verified, composer, nginx and mariadb used their default tags, and the workflows referenced actions by mutable tags or @master.

Changes

• install-php-extensions is copied from mlocati/php-extension-installer:2.13.2 pinned by digest.
• WP-CLI 2.12.0 is downloaded from its GitHub release with curl -fsSL and checked against the published SHA-512 before use.
• composer:2.11.2, nginx:1.31.8 and mariadb:13.0.2 are pinned by tag and digest. 13.0.2 is the version mariadb:latest currently resolves to, so existing data directories are not downgraded.
• Every action in the three workflows is pinned to a commit with its version in a comment, keeping the major versions already in use; ludeeus/action-shellcheck moves from master to 2.0.0.
• Renovate also manages the Dockerfiles, common-services.yml and the workflow actions. The project's own image stays out of it. The WP-CLI version and checksum are updated by hand, together.

Tests

tests/security/build-pins.bats checks that the Dockerfile has no floating downloads, that COPY --from images carry a digest, that WP-CLI comes from a release and is verified, that nginx and MariaDB are pinned, and that every uses: points to a commit. All five fail on main and pass here. bats tests/security: 23/23; ShellCheck clean.

The image builds for linux/amd64 with the default base image (WP-CLI 2.12.0, Composer 2.11.2, intl and xdebug loaded). A fresh stack with that image, the pinned nginx and MariaDB built from .docker/mariadb installs WordPress and WooCommerce, and login, wp-admin, /wp-json/, wp-cron.php, checkout and My Account work.