From 2885861a92691b8200a9b9a520179d079fbb2c37 Mon Sep 17 00:00:00 2001 From: Void Agent Date: Fri, 31 Jul 2026 18:52:14 +0100 Subject: harden deploy: strict mode, mktemp build dirs, pinned quarto digest, no fixed /tmp paths --- hooks/post-receive | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'hooks') diff --git a/hooks/post-receive b/hooks/post-receive index 378e777..8096848 100755 --- a/hooks/post-receive +++ b/hooks/post-receive @@ -19,9 +19,9 @@ exec > >(tee -a "$LOG") 2>&1 echo "=== post-receive $(date -u +%Y-%m-%dT%H:%M:%SZ) ===" BARE_DIR="$(cd "$(dirname "$0")/.." && pwd)" -BUILD_DIR="/tmp/homepage-build" -rm -rf "$BUILD_DIR" -mkdir -p "$BUILD_DIR" +# Private runtime dir — no fixed /tmp paths, cleaned up on exit +BUILD_DIR="$(mktemp -d /tmp/homepage-build.XXXXXX)" +trap 'rm -rf "$BUILD_DIR"' EXIT DEPLOYED=0 while read oldrev newrev ref; do -- cgit v1.2.3