publish new images after recent PRs are merged and tested

[szaimen]

Follow up to #7846

(add the most recent ticket for a new release here)

Errors:

Tested:

(add PRs below that are potentially breaking and need to be well tested)

• Update all instances to nc33 #7622
• update to 33.0.3
• postgres: fix healthcheck #8027
• fix: IPv6 compatibility across containers and PHP AIO interface #8019
• feat: enforce no-new-privileges for non-root containers #8018
• Aio-interface: Add "Pull new images" button while containers are running #8017
• aio-interface: fix nginx reverse proxy read timeout blocks AIO from starting consecutive containers #8016
• nextcloud: fix intermittent 502 Bad Gateway: PHP-FPM request_terminate_timeout + process_idle_timeout #8013
• Add automatic cosign keyless signing to container build and promote workflows nextcloud-releases/all-in-one#97
• Remove zizmor.yml and fix workflows to pass security audit natively nextcloud-releases/all-in-one#98
• Remove zizmor.yml suppression config and fix all workflow security findings #8005
• Add cosign image signature verification before pulling images #8006
• feat: enforce read-only root filesystem and non-root user for remaining containers #8008
• Drop as much capabilities as possibile for the Collabora container #8000
• Let manual-install use WOPI URLs internal to the Docker network #7897
• feat: enforce read-only root filesystem and non-root user for remaining containers #8008
• fulltextsearch: update Elasticsearch to v9 #8004
• caddy: revert being able to adjust the log level for it for now #8021
• allow to adjust the log level globally #7902
  • warn
    • mastercontainer
    • Apache
    • ClamAV
    • Collabora
    • OnlyOffice
    • Postgres
    • Fulltextsearch
    • Imaginary (for previews of heic, heif, illustrator, pdf, svg, tiff and webp.
    • Nextcloud (fixed with nextcloud: overwrite the log level every start #8028)
    • Notify-push
    • Redis
    • Talk
    • talk recording
    • docker-socket-proxy (deprecated)
    • whiteboard
    • HARP
  • error
    • mastercontainer
    • Apache
    • ClamAV
    • Collabora
    • OnlyOffice
    • Postgres
    • Fulltextsearch
    • Imaginary (for previews of heic, heif, illustrator, pdf, svg, tiff and webp.
    • Nextcloud (fixed with nextcloud: overwrite the log level every start #8028)
    • Notify-push
    • Redis redis: fix log level #8029
    • Talk
    • talk recording
    • docker-socket-proxy (deprecated)
    • whiteboard
    • HARP
  • info
    • mastercontainer
    • Apache
    • ClamAV
    • Collabora collabora: fix log level info #8030
    • OnlyOffice
    • Postgres
    • Fulltextsearch
    • Imaginary (for previews of heic, heif, illustrator, pdf, svg, tiff and webp.
    • Nextcloud (fixed with nextcloud: overwrite the log level every start #8028)
    • Notify-push
    • Redis cdc617d
    • Talk
    • talk recording
    • docker-socket-proxy (deprecated)
    • whiteboard
    • HARP
  • debug
    • mastercontainer
    • Apache
    • ClamAV
    • Collabora
    • OnlyOffice
    • Postgres
    • Fulltextsearch
    • Imaginary (for previews of heic, heif, illustrator, pdf, svg, tiff and webp.
    • Nextcloud (fixed with nextcloud: overwrite the log level every start #8028)
    • Notify-push
    • Redis
    • Talk
    • talk recording
    • docker-socket-proxy (deprecated)
    • whiteboard
    • HARP
• add desec #7995
• aio-interface: only set the placeholder for timezone and not the value automatically because it is confusing #7999
• aio-interface: handle SSH key authorization error explicitly in remote backup setup #7997
• aio-interface: also reset the borg backup cache when resetting the backup path #7998
• domain-check: replace curl with GuzzleHttp\Client in ConfigurationManager #7994
• aio-interface: extract Nextcloud latest-major upgrade logic to dedicated script and add UI trigger button #7988
• Nextcloud: Prevent accidental Nextcloud reinstall when PHP fails to report installed version #7987
• [Community Containers] Adding joplin-server #7983
• nextcloud: allow to configure memcache_customprefix for redis #7984
• nextcloud: adjust phpredis session timeouts to match Nextclouds config #7985
• some general fixes to the code base #7979
• nextcloud: enable taskprocessing:worker as standard service #7981
• nextcloud: adjust redis timeouts #7980
• notify-push & imaginary: terminate containers on SIGTERM #7982
• headers.Caddyfile: adjust the Permission Policy again #7976
• aio-interface: preserve old PHPSESSID session during cookie migration to survive 502s on mastercontainer update #7971
• feat(clamav): reduce RAM usage via ConcurrentDatabaseReload no and MaxThreads 2 #7972
• perf(postgresql): tune PostgreSQL settings for improved Nextcloud performance #7944
• talk: improve startup ordering, NATS tuning, signaling timeouts, and healthcheck depth #7945
• perf(nextcloud): tune OPcache, APCu, realpath_cache, output_buffering, and Redis session settings #7946
• perf(fulltextsearch): improve elasticsearch healthcheck and add performance tuning #7947
• feat: improve Redis container performance #7948
• imaginary: improve healthcheck and start.sh #7949 (fixed with 5fe6adc)
• aio-interface: enable PHP OPcache and Twig template cache #7950 (fixed with d703039 and 5c016d5)
• ContainerDefinitionFetcher: cache the containers.json in apcu #7951
• aio-interface: Complete Permissions-Policy header with all MDN-listed directives #7953
• aio-interface: cache config by mtime in ConfigurationManager to avoid redundant disk reads #7956
• aio-interface: cache reads from GetDailyBackupTimeFile based on mtime #7957
• aio-interface: combine all disable-*.js files into a single disable-containers.js #7958
• perf(apache): improve Apache container performance and correctness #7959
• aio-interface: correct variable shadowing in show-password event handler #7963
• jellyfin: allow Jellyfin to resolve lldap hostname while running in host network mode #7941
• aio-interface: Add Permissions-Policy header #7942
• collabora: Add shm_size and tmpfs to improve the performance #7943
• talk: configure janus to use local TURN server for relay candidates #7933
• Improve Hsts headers #7930
• nextcloud-entrypoint: rewrite turn and stun logic to always add turn and stun server #7926
• aio-interface: also set Origin-Agent-Cluster header #7929
• aio-interface: improve headers #7690 (fixed partially with aio-interface: correct variable shadowing in show-password event handler #7963; also test new install and check console logs and if all things load; and also test with port 8080)
• talk-recording: allow to enable hardware transcoding for the container #7928
• aio-interface: set cookie prefix to __Host-Http- #7912 (fixed with aio-interface: preserve login session across container restarts after cookie name change #7964)
• aio-interface: offer system prune button #7677
• nextcloud: add server.config.php that adds the serverid by using the hostname as key #7910
• Add Bitwarden Lite as a new community container #7814
• chore: add OCI standard labels to all Dockerfiles #7899 (fixed with 5624dde)
• update bundled Nextcloud version to v33 #7882
• app: update compatibility to 33 #7876
• postgres: update to v18 #7877 (fixed with 6d372ab and 4d8360d and eba5e11)
• postgres and nextcloud: Allow arbitrary characters in passwords (no binary required) #7898
• nextcloud-entrypoint.sh: make log-type configurable #7901
• Configurationmanager.php: atomic write for configuration.json to prevent truncation on low disk #7888
• aio-interface: improve session config and cookie store #7689
• Re-introduce "mastercontainer: make check for correct volume name more strict" #7879
• docs: add warnings about IP address and self-signed certificate limitations #7693
• aio-interface: hide Hub 26 Winter update notice #7880
• aio-interface: Punish failed login attempts with a delay #7863
• caddy: use acme shortlived profile #7823
• Add Home Assistant as new community container #7810 (fixed with home-assistant: adjust some details #7907)
• Add support of overleaf as community container #6914

Tasks to do for new release:

• make sure to merge any Helm Chart Updates PR before continuing with the list below (https://github.com/nextcloud/all-in-one/pulls?q=is%3Apr+is%3Aopen+helm+)
• increase the version number in https://github.com/nextcloud/all-in-one/blob/main/php/templates/includes/aio-version.twig
• build new images. See https://github.com/nextcloud/all-in-one/blob/main/develop.md#how-to-build-new-containers
• do a last smoke test using the develop channel (See https://github.com/nextcloud/all-in-one/blob/main/develop.md#how-to-test-things-correctly)
• test if collabora opens
• Run E2E test and wait for it to finish. See https://github.com/nextcloud/all-in-one/actions/workflows/playwright-on-workflow-dispatch.yml
• deploy from develop to beta. See https://github.com/nextcloud/all-in-one/blob/main/develop.md#how-to-promote-builds-from-develop-to-beta
• tag a new release here on github which fits the version number (and use vX.Y.Z as tag and title + Beta, use the autogenerated changelog. Important: also add the included Nextcloud version manually into the body of the release, e.g. Nextcloud 26.0.2 is included but new instances can install Nextcloud 27 directly) and make it a pre release; manually describe in the changelog what could be breaking e.g. the update to v33
• rename next milestone to the same version number
• create a new milestone that is called next
• move all open issues/PRs to that new milestone
• post in all issues and discussions that were fixed/implemented that this is now released with the new beta version and post how to switch to the beta channel (e.g. This is now released with X.Y.Z Beta. Testing and feedback is welcome! See https://github.com/nextcloud/all-in-one#how-to-switch-the-channel)
• wait a week and see if new bugs get reported and don't merge any PR into the main branch of this repo in the meantime!
• if not, publish to latest as describe below; if yes simply close this milestone and create a new one that includes the bugfixes and starts from the beginning of this guide
• deploy from beta to latest. See https://github.com/nextcloud/all-in-one/blob/main/develop.md#how-to-promote-builds-from-beta-to-latest
• Merge the automated YAML updates PR if there should be one (https://github.com/nextcloud/all-in-one/pulls?q=is%3Apr+is%3Aopen+yaml)
• change the pre-release to be a stable and the latest release and remove Beta from the title (and adjust the changelog if multiple Beta version have been pushed in the meantime without a stable release - the changelog must include all changes since the latest stable release)
• close the old milestone