harden deploy: strict mode, mktemp build dirs, pinned quarto digest, no fixed /tmp paths

1 files changed, 9 insertions, 6 deletions

diff --git a/deploy-docker.sh b/deploy-docker.sh
index ce6f4d0..69ccdce 100755
--- a/deploy-docker.sh
+++ b/deploy-docker.sh
@@ -3,8 +3,8 @@
 # post-receive hook always uses the deploy logic that matches the pushed tree.
 #
 # Designed to run ON MERU (docker-only machine) from a git archive snapshot:
-#   git archive HEAD | tar -x -C /tmp/build && bash /tmp/build/deploy-docker.sh /tmp/build <sha>
-# Quarto runs inside the official quarto/quarto container; rsync ships
+#   git archive HEAD | tar -x -C "$BUILD_DIR" && bash "$BUILD_DIR/deploy-docker.sh" "$BUILD_DIR" <sha>
+# Quarto runs inside the pinned devxygmbh/alpine-quarto container; rsync ships
 # public/ to nandi (jayrup.me).
 #
 # Usage: deploy-docker.sh <build-dir> <short-sha>
@@ -14,7 +14,9 @@ BUILD_DIR="${1:?usage: deploy-docker.sh <build-dir> <short-sha>}"
 SHORT_SHA="${2:?missing short sha}"
 cd "$BUILD_DIR"
 
-QUARTO_IMAGE="${QUARTO_IMAGE:-devxygmbh/alpine-quarto:latest}"
+# Pinned digest — update deliberately (docker pull devxygmbh/alpine-quarto:latest
+# then replace the sha256:).
+QUARTO_IMAGE="${QUARTO_IMAGE:-devxygmbh/alpine-quarto@sha256:0c0d785139b467ab75c053bc24463d2450cbf928ca8ece8d9a20dedba9568fa9}"
 # Fallback if meru can't reach jayrup.me (IPv6): DEPLOY_HOST=jayrup@100.94.131.98
 DEPLOY_HOST="${DEPLOY_HOST:-jayrup.me}"
 RUN_UID="$(id -u)"
@@ -22,7 +24,8 @@ RUN_GID="$(id -g)"
 
 # Render script runs INSIDE the container (one container spin, both passes).
 # HOME=/tmp so quarto's cache is writable by the unprivileged uid.
-cat > /tmp/homepage-render.sh <<'RENDER_EOF'
+# Written into the private build dir (not /tmp) per review finding.
+cat > "$BUILD_DIR/homepage-render.sh" <<'RENDER_EOF'
 #!/usr/bin/env bash
 set -euo pipefail
 cd /site
@@ -34,7 +37,7 @@ find . -name "*.qmd" -not -path "./.*" -not -path "./public/*" | while read -r f
     quarto render "$file" --to plain --output "${base_name}.txt" --output-dir "public/$rel_dir"
 done
 RENDER_EOF
-chmod +x /tmp/homepage-render.sh
+chmod +x "$BUILD_DIR/homepage-render.sh"
 
 echo ">> rendering with $QUARTO_IMAGE (commit $SHORT_SHA)"
 # --entrypoint /bin/bash overrides whatever entrypoint the image declares
@@ -43,7 +46,7 @@ docker run --rm \
     -u "$RUN_UID:$RUN_GID" \
     -e HOME=/tmp \
     -v "$BUILD_DIR":/site \
-    -v /tmp/homepage-render.sh:/render.sh:ro \
+    -v "$BUILD_DIR/homepage-render.sh":/render.sh:ro \
     -w /site \
     "$QUARTO_IMAGE" /render.sh