harden deploy: strict mode, mktemp build dirs, pinned quarto digest, no fixed /tmp paths

1 files changed, 3 insertions, 3 deletions

diff --git a/hooks/post-receive b/hooks/post-receive
index 378e777..8096848 100755
--- a/hooks/post-receive
+++ b/hooks/post-receive
@@ -19,9 +19,9 @@ exec > >(tee -a "$LOG") 2>&1
 echo "=== post-receive $(date -u +%Y-%m-%dT%H:%M:%SZ) ==="
 
 BARE_DIR="$(cd "$(dirname "$0")/.." && pwd)"
-BUILD_DIR="/tmp/homepage-build"
-rm -rf "$BUILD_DIR"
-mkdir -p "$BUILD_DIR"
+# Private runtime dir — no fixed /tmp paths, cleaned up on exit
+BUILD_DIR="$(mktemp -d /tmp/homepage-build.XXXXXX)"
+trap 'rm -rf "$BUILD_DIR"' EXIT
 
 DEPLOYED=0
 while read oldrev newrev ref; do