Auto-rebuild when the upstream official PHP base image changes)

[twiesing]

Problem

serversideup/php is built FROM the official php:* images and rebuilt weekly (prod: Tuesdays 08:00 UTC). When a new official digest lands mid-week — e.g. a PHP security release — it only reaches serversideup/php at the next weekly rebuild unless someone triggers a manual one (like today, #720/#721). Anyone on a rolling tag can then run unpatched PHP for up to ~7 days even though the fix is already in the base image. Today was extreme, but the same gap hits smaller CVEs and OS security updates too.

Solution

Also trigger a rebuild when an upstream base digest changes, not just weekly: a scheduled job (e.g. hourly) compares docker buildx imagetools inspect --raw php:<minor>-<variant>-<os> against the last build's digests and dispatches the existing production build on a change; the weekly cron stays as fallback.

Today's handling was great, thank you — this is only about closing the mid-week gap. @jaydrogers ❤️

[jaydrogers]

Thanks for the idea! I took some time to reflect and published this here: #727

If you can chime in on there, that would be great!