diff options
Diffstat (limited to 'deploy-docker.sh')
| -rwxr-xr-x | deploy-docker.sh | 15 |
1 files changed, 9 insertions, 6 deletions
diff --git a/deploy-docker.sh b/deploy-docker.sh index ce6f4d0..69ccdce 100755 --- a/deploy-docker.sh +++ b/deploy-docker.sh @@ -3,8 +3,8 @@ # post-receive hook always uses the deploy logic that matches the pushed tree. # # Designed to run ON MERU (docker-only machine) from a git archive snapshot: -# git archive HEAD | tar -x -C /tmp/build && bash /tmp/build/deploy-docker.sh /tmp/build <sha> -# Quarto runs inside the official quarto/quarto container; rsync ships +# git archive HEAD | tar -x -C "$BUILD_DIR" && bash "$BUILD_DIR/deploy-docker.sh" "$BUILD_DIR" <sha> +# Quarto runs inside the pinned devxygmbh/alpine-quarto container; rsync ships # public/ to nandi (jayrup.me). # # Usage: deploy-docker.sh <build-dir> <short-sha> @@ -14,7 +14,9 @@ BUILD_DIR="${1:?usage: deploy-docker.sh <build-dir> <short-sha>}" SHORT_SHA="${2:?missing short sha}" cd "$BUILD_DIR" -QUARTO_IMAGE="${QUARTO_IMAGE:-devxygmbh/alpine-quarto:latest}" +# Pinned digest — update deliberately (docker pull devxygmbh/alpine-quarto:latest +# then replace the sha256:). +QUARTO_IMAGE="${QUARTO_IMAGE:-devxygmbh/alpine-quarto@sha256:0c0d785139b467ab75c053bc24463d2450cbf928ca8ece8d9a20dedba9568fa9}" # Fallback if meru can't reach jayrup.me (IPv6): DEPLOY_HOST=jayrup@100.94.131.98 DEPLOY_HOST="${DEPLOY_HOST:-jayrup.me}" RUN_UID="$(id -u)" @@ -22,7 +24,8 @@ RUN_GID="$(id -g)" # Render script runs INSIDE the container (one container spin, both passes). # HOME=/tmp so quarto's cache is writable by the unprivileged uid. -cat > /tmp/homepage-render.sh <<'RENDER_EOF' +# Written into the private build dir (not /tmp) per review finding. +cat > "$BUILD_DIR/homepage-render.sh" <<'RENDER_EOF' #!/usr/bin/env bash set -euo pipefail cd /site @@ -34,7 +37,7 @@ find . -name "*.qmd" -not -path "./.*" -not -path "./public/*" | while read -r f quarto render "$file" --to plain --output "${base_name}.txt" --output-dir "public/$rel_dir" done RENDER_EOF -chmod +x /tmp/homepage-render.sh +chmod +x "$BUILD_DIR/homepage-render.sh" echo ">> rendering with $QUARTO_IMAGE (commit $SHORT_SHA)" # --entrypoint /bin/bash overrides whatever entrypoint the image declares @@ -43,7 +46,7 @@ docker run --rm \ -u "$RUN_UID:$RUN_GID" \ -e HOME=/tmp \ -v "$BUILD_DIR":/site \ - -v /tmp/homepage-render.sh:/render.sh:ro \ + -v "$BUILD_DIR/homepage-render.sh":/render.sh:ro \ -w /site \ "$QUARTO_IMAGE" /render.sh |