[vitormattos]

Summary

• Replace local builds of app, cron and web with prebuilt GHCR images in both standard and Garage S3 Docker Compose deployments.
• Keep the shared application image selector as ghcr.io/librecodecoop/nextcloud-docker-app:${NEXTCLOUD_VERSION:-stable-fpm}; cron and app use the same resolved image, with the existing /cron.sh entrypoint preserved.
• Keep the independent nextcloud-docker-web:main image for web.
• Change .env.example to NEXTCLOUD_VERSION=stable-fpm, following the existing reviewed image promotion logic. The approved inventory currently has major 35 as its newest entry; no Compose or test logic hardcodes a Nextcloud major.
• Update English and Portuguese README and deployment documentation and the image policy to describe published-image selection, explicit pull, and deployment without --build.

Regression tests

tests/compose-images.bats uses only docker compose config and jq (no image pulls, no real containers, no dependency on the continued existence of a particular version tag). It checks the standard and Garage S3 variants for:

1. stable-fpm as the fallback when the version is unset or empty;
2. propagation of an arbitrary test-only tag to both app and cron;
3. independent web:main image, the cron entrypoint and absence of build in all three services.

The example environment selecting stable-fpm is also tested. An additional dry-run contract test verifies that maintainer builds use the reviewed upstream base and preserve shell-variable expansion without running Docker. These tests run in the existing make test-ci-scripts job.

Historical 33/34/35 fixtures in other regression suites and the supported-version inventory are intentionally unchanged. A maintained major being older than the newest does not make it invalid.

Operational considerations

stable-fpm is a moving tag. It is currently promoted from the newest reviewed supported major by scripts/publish-images.sh. When Nextcloud 36 or a later major is approved, the alias can advance; unattended pulls/recreates can therefore require an upgrade or migration. Production deployments should set NEXTCLOUD_VERSION=<supported-major>-fpm (or an immutable digest) and plan major upgrades explicitly.

Makefile maintainer targets (make test-current-app-image, make scan-images) now select the latest reviewed upstream image and digest from .github/nextcloud-supported.json, independently of the sample deployment .env. This also corrects the previous GNU Make shell-variable escaping in their build arguments ($version versus $base_image). The base can be overridden with APP_BASE_IMAGE.

No changes to Dockerfiles, published-image workflows, volumes, networks, secrets, application hooks or PostgreSQL versions. Builds for image maintainers remain available.

Related to #47.

Validation

• Regression tests added to the existing CI gate.
• All commits GPG-verified and DCO-signed.
• CI status to be checked on the final commit before merge.