[davidnewhall]

Summary

• Pin the Docker workflow Actions to current release SHAs, and run the container test before anything is pushed.
• Point Renovate at ghcr.io/linuxserver/nginx and automerge those image updates, plus Actions updates, only after checks pass.
• Extend the license copyright through 2026.

Test plan

• Built notifiarr-nginx-citest:local on slvr and ran .github/scripts/test-image.sh (terser minify, node, php ddtrace, gzip, curl, unraiddocker group, nginx HTTP 200).
• Built the botmanager variant (openssh-client, docker, gzip) and ran the same script with the bot checks (ssh and docker CLI).
• GitHub Actions build job passes on this PR, including both image tests, and does not push.
• After merge, a Renovate digest PR for ghcr.io/linuxserver/nginx waits for build and then automerges.

Made with Cursor

[Copilot]

🔵 Needs a closer look

Human confirmation of the pending CI build and required-check protection settings is needed before relying on automatic dependency merges.

No open issues 🎉

What changed in this PR

This PR adds runtime validation before publishing the nginx images and updates dependency automation.

Changes:

• Pin workflow Actions to release SHAs and test both image variants before publishing.
• Configure Renovate to pin nginx image digests and automerge image and Actions updates.
• Extend the license copyright through 2026.

File	Description
LICENSE	Extends the copyright year range through 2026.
.github/​workflows/​docker-publish.yml	Pins Actions and gates publishing on both image tests.
.github/​scripts/​test-image.sh	Adds runtime checks for installed tools, group membership, and nginx responses.
.github/​renovate.json	Targets the nginx base image and enables image and Actions automerging.

_{Review effort: Balanced}