sneak/lora.vegas
1
0
Fork 0
Code Issues 11 Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "Merge pull request '#17: Hash-pin every external reference in deploy.yml (closes #7)'"
All checks were successful
check / check (push) Successful in 4s
Details
Build and Deploy to Cloudflare Pages / build (push) Successful in 5s
Details
Build and Deploy to Cloudflare Pages / deploy (push) Successful in 19s
Details

Browse Source 
This reverts commit 74c28c1d71, reversing
changes made to 7cad989724.
This commit is contained in:
Jeffrey Paul
2026-08-09 02:37:18 +00:00
parent 74c28c1d71
commit 3d17e22385
2 changed files with 44 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
TODO.md
View File

@@ -14,8 +14,7 @@ pre-1.0
No git tags. The site is live and now has the scripts-to-rule-them-all scaffold
(`Makefile`, `script/`, `Dockerfile`, `check.yml`); still missing `LICENSE` and
policy files. Every external reference in the repo is now pinned by
cryptographic hash (or, for the wrangler CLI install, an exact version).
policy files.
# Next Step
@@ -25,17 +24,6 @@ Update `README.md` accordingly.
# Completed Steps
- 2026-08-09: hash-pinned every external reference in
`.gitea/workflows/deploy.yml` (closes #7): both job container images are
pinned by digest, all three `uses:` are pinned by 40-hex commit SHA
(`upload`/`download-artifact` moved v3 to v4), and the wrangler install is
pinned to an exact version. The abandoned `klakegg/hugo:ext-alpine` image is
gone: the build job now runs on the same pinned `alpine` digest the
`Dockerfile` uses, with a pre-checkout `apk add nodejs git tar` step (the
Actions runner needs `node` inside the job container to execute JavaScript
actions), an explicit `shell: sh` default, then `script/bootstrap` and
`script/test`. Also dropped the dead `feat/initial-site` push trigger and
reindented the file to 4-space YAML to match `check.yml`
- 2026-07-25: added the scripts-to-rule-them-all scaffold (closes #4): `script/`
entrypoints, `Makefile` shims, a Hugo `Dockerfile` (sha256-pinned alpine) plus
`.dockerignore` that runs `make check`, `.gitea/workflows/check.yml` running
@@ -52,6 +40,9 @@ Update `README.md` accordingly.
# Future Steps
- Pin the images and actions in `deploy.yml` by sha256
(`klakegg/hugo:ext-alpine`, `node:20`, `actions/checkout`,
`upload`/`download-artifact` are all unpinned)
- Rework README.md into the standard sections: Description, Getting Started,
Rationale, Design, TODO, License, Author (currently About, Contributing,
Technical Details, License)