diff options
| -rwxr-xr-x | deploy-docker.sh | 15 | ||||
| -rwxr-xr-x | deploy.sh | 21 | ||||
| -rwxr-xr-x | hooks/post-receive | 6 |
3 files changed, 30 insertions, 12 deletions
diff --git a/deploy-docker.sh b/deploy-docker.sh index ce6f4d0..69ccdce 100755 --- a/deploy-docker.sh +++ b/deploy-docker.sh @@ -3,8 +3,8 @@ # post-receive hook always uses the deploy logic that matches the pushed tree. # # Designed to run ON MERU (docker-only machine) from a git archive snapshot: -# git archive HEAD | tar -x -C /tmp/build && bash /tmp/build/deploy-docker.sh /tmp/build <sha> -# Quarto runs inside the official quarto/quarto container; rsync ships +# git archive HEAD | tar -x -C "$BUILD_DIR" && bash "$BUILD_DIR/deploy-docker.sh" "$BUILD_DIR" <sha> +# Quarto runs inside the pinned devxygmbh/alpine-quarto container; rsync ships # public/ to nandi (jayrup.me). # # Usage: deploy-docker.sh <build-dir> <short-sha> @@ -14,7 +14,9 @@ BUILD_DIR="${1:?usage: deploy-docker.sh <build-dir> <short-sha>}" SHORT_SHA="${2:?missing short sha}" cd "$BUILD_DIR" -QUARTO_IMAGE="${QUARTO_IMAGE:-devxygmbh/alpine-quarto:latest}" +# Pinned digest — update deliberately (docker pull devxygmbh/alpine-quarto:latest +# then replace the sha256:). +QUARTO_IMAGE="${QUARTO_IMAGE:-devxygmbh/alpine-quarto@sha256:0c0d785139b467ab75c053bc24463d2450cbf928ca8ece8d9a20dedba9568fa9}" # Fallback if meru can't reach jayrup.me (IPv6): DEPLOY_HOST=jayrup@100.94.131.98 DEPLOY_HOST="${DEPLOY_HOST:-jayrup.me}" RUN_UID="$(id -u)" @@ -22,7 +24,8 @@ RUN_GID="$(id -g)" # Render script runs INSIDE the container (one container spin, both passes). # HOME=/tmp so quarto's cache is writable by the unprivileged uid. -cat > /tmp/homepage-render.sh <<'RENDER_EOF' +# Written into the private build dir (not /tmp) per review finding. +cat > "$BUILD_DIR/homepage-render.sh" <<'RENDER_EOF' #!/usr/bin/env bash set -euo pipefail cd /site @@ -34,7 +37,7 @@ find . -name "*.qmd" -not -path "./.*" -not -path "./public/*" | while read -r f quarto render "$file" --to plain --output "${base_name}.txt" --output-dir "public/$rel_dir" done RENDER_EOF -chmod +x /tmp/homepage-render.sh +chmod +x "$BUILD_DIR/homepage-render.sh" echo ">> rendering with $QUARTO_IMAGE (commit $SHORT_SHA)" # --entrypoint /bin/bash overrides whatever entrypoint the image declares @@ -43,7 +46,7 @@ docker run --rm \ -u "$RUN_UID:$RUN_GID" \ -e HOME=/tmp \ -v "$BUILD_DIR":/site \ - -v /tmp/homepage-render.sh:/render.sh:ro \ + -v "$BUILD_DIR/homepage-render.sh":/render.sh:ro \ -w /site \ "$QUARTO_IMAGE" /render.sh @@ -1,7 +1,18 @@ #!/usr/bin/env bash +# deploy.sh — local native-quarto build + deploy for jayrup.me. +# For machines with quarto installed natively (e.g. Arch laptop / voidlaptop). +# The Docker-based path is deploy-docker.sh (used by meru's post-receive hook). +# +# Strict mode: a failed render exits BEFORE rsync --delete can touch the VPS. +set -euo pipefail -# 1. Clear the old garbage -rm -rf public/ +# 1. Render into a fresh temp dir so a partial build never gets deployed +BUILD_DIR="$(mktemp -d /tmp/homepage-local.XXXXXX)" +trap 'rm -rf "$BUILD_DIR"' EXIT +cd "$BUILD_DIR" +git archive --format=tar --output=tree.tar HEAD +tar xf tree.tar +rm tree.tar # 2. Render the whole website (HTML) # This creates the directories and index.html files correctly @@ -14,7 +25,7 @@ find . -name "*.qmd" -not -path "./.*" -not -path "./public/*" | while read -r f rel_dir=$(dirname "${file#./}") # Get the filename without extension (e.g., index) base_name=$(basename "$file" .qmd) - + # Render to plain text directly into the correct public sub-directory quarto render "$file" --to plain --output "${base_name}.txt" --output-dir "public/$rel_dir" done @@ -28,6 +39,10 @@ cp cv/index.txt public/cv.txt cp assets/dissertation.pdf public/dissertation.pdf cp assets/public_key public/public_key +# 6. Deploy marker +printf 'deployed %s commit %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$(git rev-parse --short HEAD)" > public/last-deploy.txt + echo "Pushing to vps" +# Only reached if all renders succeeded (set -e) rsync -avz --delete public/ jayrup.me:~/homepage/public/ diff --git a/hooks/post-receive b/hooks/post-receive index 378e777..8096848 100755 --- a/hooks/post-receive +++ b/hooks/post-receive @@ -19,9 +19,9 @@ exec > >(tee -a "$LOG") 2>&1 echo "=== post-receive $(date -u +%Y-%m-%dT%H:%M:%SZ) ===" BARE_DIR="$(cd "$(dirname "$0")/.." && pwd)" -BUILD_DIR="/tmp/homepage-build" -rm -rf "$BUILD_DIR" -mkdir -p "$BUILD_DIR" +# Private runtime dir — no fixed /tmp paths, cleaned up on exit +BUILD_DIR="$(mktemp -d /tmp/homepage-build.XXXXXX)" +trap 'rm -rf "$BUILD_DIR"' EXIT DEPLOYED=0 while read oldrev newrev ref; do |