fix(security): Stop publishing EOL PHP 8.1 and reject vulnerable dev runtimes

.docker/Dockerfile.php81

@@ -1,3 +1,5 @@
+# UNSUPPORTED: PHP 8.1 has no official security release for CVE-2026-109618/109619.
+# This Dockerfile is kept for historical reference and excluded from GHCR publishing.
 FROM php:8.1-fpm
 
 RUN apt-get update \

.docker/Dockerfile.php82

@@ -1,4 +1,6 @@
-FROM php:8.2-fpm
+FROM php:8.2.35-fpm@sha256:a58479410c94b3f0f7dfacc27fba8befc122290743fd0eb8c88a99ff2a0b1ba1
+
+
 
 RUN apt-get update \
     && apt-get install -y \

.docker/Dockerfile.php83

@@ -1,4 +1,6 @@
-FROM php:8.3-fpm
+FROM php:8.3.36-fpm@sha256:d0dea3f5d95314eac94a732469f4cf0ee658a22c2ce3f2612272b9d5b42d1a72
+
+
 
 RUN apt-get update \
     && apt-get install -y \

.github/workflows/docker-nginx.yml

@@ -25,6 +25,7 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4
       - name: Set up Docker Buildx
+        id: buildx
         uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
       - name: Cache Docker layers
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6

.github/workflows/docker-php.yml

@@ -1,8 +1,6 @@
 name: 'Docker PHP Publish'
 
 on:
-  schedule:
-    - cron: '0 2 * * *'
   pull_request:
   push:
     branches:
@@ -20,12 +18,9 @@ jobs:
       fail-fast: false
       matrix:
         container:
-          - php81
           - php82
           - php83
         include:
-          - container: php81
-            version: '8.1'
           - container: php82
             version: '8.2'
           - container: php83
@@ -39,6 +34,7 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4
       - name: Set up Docker Buildx
+        id: buildx
         uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
       - name: Cache Docker layers
         id: docker-cache
@@ -65,6 +61,7 @@ jobs:
       - name: Build container image
         uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
+          pull: true
           push: false
           context: .docker/
           platforms: linux/amd64,linux/arm64
@@ -77,6 +74,7 @@ jobs:
         uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         if: github.ref == 'refs/heads/main'
         with:
+          pull: true
           push: true
           context: .docker/
           platforms: linux/amd64,linux/arm64