[YvesCesar]

What was wrong

Everything the stack runs from source followed a moving branch or tag: the WordPress plugins and theme were cloned from their default branch (two of them from third-party mirrors, polylang-pro from GitLab and woocommerce-subscriptions from Pronamic), the Nextcloud apps and the static site were fast-forwarded to main on every make up, the E2E stack downloaded the apps from main, and Mailpit used latest. A commit pushed to any of these sources ran on the next install with access to the database and to the Nextcloud admin credentials.

What changed

• Each custom plugin in WORDPRESS_SETUP_CONFIG_YAML starts its post_install_commands with a fetch and checkout of a fixed commit, the current head of its default branch. The image runs these commands on every boot, so an existing clone is moved to the pinned commit too.
• The image does not run post_install_commands for themes, so the libresign-wp-customizations entry clones the theme when it is missing and checks out its pinned commit. The image then finds the theme directory and skips its own clone.
• SITE_REPO_REF, ADMIN_GROUP_MANAGER_REF and WORDPRESS_LOGIN_BACKEND_REF in the Makefile replace the main branch: make up fetches and checks out the commit instead of pulling.
• The E2E stack downloads admin_group_manager and wordpress_login_backend at the same commits.
• Mailpit is pinned to v1.31.2, the version the E2E stack already uses.
• The README says where the pins live.

LibreCodeCoop/wordpress-docker#45 adds a ref field for plugins and themes. Once it is merged and the submodule is bumped, these checkout commands can be replaced by that field.

How it was verified

• Playwright suite on the saas-e2e stack built from scratch, which inherits the plugin list: 14 passed.
• In that stack every plugin and the theme are at the pinned commit (git rev-parse HEAD), Mailpit reports v1.31.2, and the two Nextcloud apps are installed from the archives of the pinned commits.
• make -n shows the checkout of each ref and no pull.