OCIS_FULL deployment example: use renovate to enhance security

[dj4oC]

Summary

This PR hardens the deployments/examples/ocis_full Docker Compose example by pinning Docker images to tag@digest (deterministic + security rebuild aware) and adds automation so image updates become reviewable PRs instead of silent drift.

What’s included

• Digest pinning (secure-by-default): all image: references in deployments/examples/ocis_full/**/*.yml are now pinned as repo:tag@sha256:digest.
• Renovate config: adds renovate.json (repo root) to automatically detect newer tags/digests for the ocis_full compose files and open PRs for QA.
• Smoke test (iteration 1, intentionally simple): adds .github/workflows/ocis-full-smoke.yml to:
• run docker compose --env-file .env config
• docker compose up -d, wait briefly, print ps + logs tail
• teardown always

Why this change

• We cannot use latest due to breaking changes risk.
• Pinned tags alone are not enough: vendors often ship security fixes as rebuilds under the same tag (new digest). Digest pinning + Renovate gives us controlled updates with an audit trail and QA gate.

Known issue / follow-up

• collabora starts but remains unhealthy, which can block deployments if any service uses depends_on: condition: service_healthy.
• Follow-up: align Collabora healthcheck/readiness (or relax dependency gating for iteration 1) so docker compose up doesn’t fail due to healthcheck semantics.

Activation required (Org Admin action)

renovate.json is committed, but Renovate won’t run until one of the following is enabled:

Option A (preferred): Install Renovate GitHub App for this repo only
1. Install Renovate (Mend) GitHub App for the org
2. Choose Only select repositories
3. Select owncloud/ocis
4. Ensure permissions allow creating branches + PRs (contents + pull-requests write)

Option B: Run Renovate via GitHub Actions (if App install isn’t possible)
• Provide a bot token and store it as repo secret RENOVATE_TOKEN
• Add a scheduled workflow to execute Renovate (I can add this once the secret exists)

How to test

From deployments/examples/ocis_full:

docker compose --env-file .env config >/dev/null
docker compose --env-file .env up -d
sleep 45
docker compose ps
docker compose logs --no-color --tail=200
docker compose --env-file .env down -v --remove-orphans

Expected outcome
• Users of ocis_full always pull a deterministic, reviewed image set.
• Security rebuilds and upstream image updates become visible Renovate PRs routed to QA.

[update-docs]

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.

[Copilot]

Pull request overview

This PR enhances the security and maintainability of the ocis_full deployment example by implementing Docker image digest pinning and automated dependency update tracking. The changes ensure deterministic deployments and provide visibility into security updates through Renovate-generated pull requests, moving away from potentially unstable latest tags while avoiding the security risks of static pinned tags.

Changes:

• Added digest pinning to all Docker images in ocis_full compose files (tag@sha256:digest format)
• Added Renovate configuration to automate detection and PRs for image updates
• Added GitHub Actions smoke test workflow to validate compose configurations on PR changes

Reviewed changes

Copilot reviewed 17 out of 18 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
renovate.json	New Renovate configuration for automated Docker image update detection in ocis_full
deployments/examples/ocis_full/web_extensions/unzip.yml	Added digest pinning and platform specification for unzip extension
deployments/examples/ocis_full/web_extensions/progressbars.yml	Added digest pinning and platform specification for progressbars extension
deployments/examples/ocis_full/web_extensions/jsonviewer.yml	Added digest pinning and platform specification for jsonviewer extension
deployments/examples/ocis_full/web_extensions/importer.yml	Added digest pinning and platform specification for importer and companion services
deployments/examples/ocis_full/web_extensions/externalsites.yml	Added digest pinning and platform specification for externalsites extension
deployments/examples/ocis_full/web_extensions/drawio.yml	Added digest pinning and platform specification for drawio extension
deployments/examples/ocis_full/tika.yml	Added digest pinning and platform specification, updated from latest-full to specific version
deployments/examples/ocis_full/onlyoffice.yml	Added digest pinning and platform specification for OnlyOffice and collaboration services
deployments/examples/ocis_full/ocis.yml	Added digest pinning and platform specification for main oCIS service
deployments/examples/ocis_full/minio.yml	Added digest pinning and platform specification, updated to versioned release tag
deployments/examples/ocis_full/mailserver.yml	Added digest pinning and platform specification for mailpit service
deployments/examples/ocis_full/docker-compose.yml	Added digest pinning and platform specification for Traefik
deployments/examples/ocis_full/collabora.yml	Added digest pinning and platform specification for Collabora and collaboration services
deployments/examples/ocis_full/clamav.yml	Added digest pinning and platform specification for ClamAV
deployments/examples/ocis_full/.env	Added IMAGE_ARCH variable, emptied DOCKER_TAG variables, added documentation comments for manual override
.gitignore	Added .DS_Store to ignore macOS system files
.github/workflows/ocis-full-smoke.yml	New smoke test workflow to validate ocis_full compose configuration on PRs

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[dj4oC]

Addressed all issues

[Copilot]

Pull request overview

Copilot reviewed 17 out of 18 changed files in this pull request and generated 5 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Several image override env vars (e.g. TRAEFIK_DOCKER_TAG, OCIS_DOCKER_IMAGE/OCIS_DOCKER_TAG, TIKA_IMAGE, COLLABORA_DOCKER_TAG, CLAMAV_DOCKER_TAG, ONLYOFFICE_IMAGE, MAIL_SERVER_DOCKER_TAG, COMPANION_IMAGE) are now documented as “manual override only”, but they are no longer referenced by any compose file under deployments/examples/ocis_full after switching to hard-pinned image: ...@sha256:.... This is misleading because editing .env won’t change the pulled images anymore. Either reintroduce env interpolation (with the pinned tag@digest as the default) or remove/rename these variables and update the comments accordingly.

[dj4oC]

@copilot open a new pull request to apply changes based on this feedback

[2403905]

This is a point. We should have a consistent definition. In my opinion the COMPANION_DOCKER_IMAGE definition looks correct.
image: ${COMPANION_DOCKER_IMAGE:-transloadit/companion:5.8.0@sha256:65052a640897deb14fdf449fa88a121b8648f0fb06c52a1503fa4b3bb1d2564f}

Replace the TRAEFIK_DOCKER_TAG to TRAEFIK_DOCKER_IMAGE
and uses it:
image: ${TRAEFIK_DOCKER_IMAGE:-traefik:v3.6.7@sha256:a9890c898f379c1905ee5b28342f6b408dc863f08db2dab20e46c267d1ff463a}

For Ocis:
image: ${OCIS_DOCKER_IMAGE:-owncloud/ocis}:${OCIS_DOCKER_TAG:-latest} it will be replased by:

image: ${OCIS_DOCKER_IMAGE:-owncloud/ocis:8.0.0@sha256:41e6d78f43507015e0c34b87bff49ae0744f261a92916f044e47d32067ff18ce}

Therefore, we no longer use *_DOCKER_TAG variables. Use only *_DOCKER_IMAGE if necessary.

[2403905]

The variable's name could be confusing there. It was OCIS_DOCKER_IMAGE:OCIS_DOCKER_TAG -> owncloud/ocis:tag_name, and then I proposed using the same variable OCIS_DOCKER_IMAGE for full image definition OCIS_DOCKER_IMAGE -> owncloud/ocis:tag_name it could break something.
@kobergj Maybe we need a new pattern like *_DOCKER_IMAGE_NAME or *_IMAGE

For Ocis:
image: ${OCIS_DOCKER_IMAGE:-owncloud/ocis}:${OCIS_DOCKER_TAG:-latest} it will be replased by:

image: ${OCIS_DOCKER_IMAGE:-owncloud/ocis:8.0.0@sha256:41e6d78f43507015e0c34b87bff49ae0744f261a92916f044e47d32067ff18ce}

[Copilot]

@dj4oC I've opened a new pull request, #12066, to work on those changes. Once the pull request is ready, I'll request review from you.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[2403905]

This is a point. We should have a consistent definition. In my opinion the COMPANION_DOCKER_IMAGE definition looks correct.
image: ${COMPANION_DOCKER_IMAGE:-transloadit/companion:5.8.0@sha256:65052a640897deb14fdf449fa88a121b8648f0fb06c52a1503fa4b3bb1d2564f}

Replace the TRAEFIK_DOCKER_TAG to TRAEFIK_DOCKER_IMAGE
and uses it:
image: ${TRAEFIK_DOCKER_IMAGE:-traefik:v3.6.7@sha256:a9890c898f379c1905ee5b28342f6b408dc863f08db2dab20e46c267d1ff463a}

For Ocis:
image: ${OCIS_DOCKER_IMAGE:-owncloud/ocis}:${OCIS_DOCKER_TAG:-latest} it will be replased by:

image: ${OCIS_DOCKER_IMAGE:-owncloud/ocis:8.0.0@sha256:41e6d78f43507015e0c34b87bff49ae0744f261a92916f044e47d32067ff18ce}

Therefore, we no longer use *_DOCKER_TAG variables. Use only *_DOCKER_IMAGE if necessary.

[LukasHirt]

Option A (preferred): Install Renovate GitHub App for this repo only

1. Install Renovate (Mend) GitHub App for the org
2. Choose Only select repositories
3. Select owncloud/ocis
4. Ensure permissions allow creating branches + PRs (contents + pull-requests write)

Just a quick note: Renovate app is already installed in the org as we are using it in several FE repositories (web, web-extensions, web-app-skeleton).