Merge pull request '#22: Hash-pin every external reference in deploy.yml (closes #7)'

deploy.yml was the last file in the repo carrying mutable external references.
Both job container images are now pinned by digest, all three `uses:` by a full
40-hex commit SHA, and the wrangler install by exact version, each with a
version/date comment above the reference.

- build container: klakegg/hugo:ext-alpine (abandoned since 2021, mutable tag)
  replaced by the exact alpine 3.21 digest the Dockerfile already pins, with a
  pre-checkout `apk add --no-cache nodejs git tar` step, `shell: sh` as the job
  default, then script/bootstrap and script/test. One pinned base and one
  dependency list now serve both the check build and the deploy build.
- deploy container: node:20 -> node@sha256:8f693eaa... (node 20.20.2 bookworm).
- actions/checkout: v4 -> 11bd7190... (v4.2.2), the same SHA check.yml pins.
- actions/upload-artifact: -> ff15f030... (v3.2.1).
- actions/download-artifact: -> 9bc31d5c... (v3.0.2).
- wrangler: `npm install -g wrangler` -> `wrangler@4.86.0`.

Also drops the dead feat/initial-site push trigger, reindents to 4-space YAML
to match check.yml, and adds `if: github.ref_name == 'main'` to the deploy job
so it can never publish from a branch.

This is the second attempt. The first passed two adversarial reviews, merged,
and broke the deploy, because deploy.yml triggers only on push to main and so
nobody could execute what they were reviewing. This time the workflow was
temporarily triggered on the branch, with the deploy job guarded off, and
iterated against the commit-status API until the build job ran green for real.
Doing that found two independent breaks that review had not:

1. actions/upload-artifact v4 fails on this Gitea Actions instance -- artifacts
   v4 is a different wire protocol and it is not served here. Two otherwise
   identical branch jobs, one with the v4 upload step and one without, failed
   and passed respectively. The issue asked for the v3 -> v4 bump; the
   artifact actions instead stay on the v3 line, pinned by SHA, at the exact
   commits the mutable @v3 references were already resolving to. Tracked
   separately in issue 20.
2. wrangler 4.120.0 requires node >= 22 and refuses to start on the pinned
   node 20 container. `npm install` only warns about engines, so the install
   step would have passed and the deploy step would have failed. The unpinned
   command this replaces was never installing `latest` either: npm resolves a
   bare name to the newest version whose engines the running node satisfies,
   which on node 20 is 4.86.0. So 4.86.0 is what has actually been deploying
   this site, and that is what is pinned. Tracked separately in issue 21.

The temporary branch trigger and the temporary probe workflow used to bisect
this are removed in this commit; the deploy guard is deliberately kept.

Verified: make check and script/cibuild green; the build job observed green on
the branch under act_runner (commit 73f912c, "Successful in 7s"); a probe job
pair rehearsed the deploy job end to end -- same pinned node image, same pinned
download action, same pinned wrangler, real site tarball extracted -- stopping
at `wrangler pages deploy --help` instead of publishing. The real deploy job
remains unexercised: it needs CLOUDFLARE_API_TOKEN and would publish, so it can
only run on main. The main run must still be watched and the live site
confirmed.

.dockerignore

@@ -0,0 +1,4 @@
+.git
+public
+resources
+.hugo_build.lock

.gitea/workflows/check.yml

@@ -0,0 +1,9 @@
+name: check
+on: [push]
+jobs:
+    check:
+        runs-on: ubuntu-latest
+        steps:
+            # actions/checkout v4.2.2, 2026-02-28
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+            - run: script/cibuild

.gitea/workflows/deploy.yml

@@ -3,28 +3,64 @@ name: Build and Deploy to Cloudflare Pages
 on:
     push:
         branches:
-      - feat/initial-site
             - main
 
 jobs:
     build:
         runs-on: ubuntu-latest
         container:
-      image: klakegg/hugo:ext-alpine
+            # Same digest the Dockerfile pins: one pinned base image and the
+            # same dependency list (script/bootstrap) for both the check build
+            # and the deploy build. The one extra thing this job needs on top
+            # of the Dockerfile is the Actions runner's own prerequisites --
+            # see the first step.
+            # alpine 3.21, 2026-02-28
+            image: alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
+        defaults:
+            run:
+                # The default step shell is bash; this image has only busybox
+                # sh, so say so explicitly rather than rely on a fallback.
+                shell: sh
         steps:
+            # This image is bare busybox+musl. act_runner executes JavaScript
+            # actions (checkout, upload-artifact) with `node` *inside* the job
+            # container and does not inject one, so node has to exist before
+            # the first `uses:` step -- script/bootstrap runs too late. git is
+            # needed for checkout's `submodules: recursive` (without it
+            # checkout degrades to a tarball download that cannot do
+            # submodules). An inline `run:` needs only a shell, so this step
+            # works on the bare image. These apk packages resolve at run time
+            # and are not hash-pinned; that gap is repo-wide (script/bootstrap
+            # has it too) and is tracked in #19.
+            - name: Install runner prerequisites
+              run: apk add --no-cache nodejs git tar
+
             - name: Checkout
-        uses: actions/checkout@v4
+              # actions/checkout v4.2.2, 2026-02-28
+              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
               with:
                   submodules: recursive
 
+            - name: Install build dependencies
+              run: script/bootstrap
+
             - name: Build site
-        run: hugo --minify
+              run: script/test
 
             - name: Archive site
               run: tar -czf site.tar.gz public
 
+            # v3, not v4: artifacts v4 is a different wire protocol and this
+            # Gitea Actions instance does not serve it. That is what broke the
+            # deploy in run 25 -- measured by running two otherwise identical
+            # jobs on a branch, one ending in upload-artifact v4 (failed) and
+            # one without that step (passed). Tracked in #20. This SHA is the
+            # exact commit the mutable `@v3` used to resolve to, i.e. the code
+            # that was already deploying this site, now pinned rather than
+            # floating.
             - name: Upload artifact
-        uses: actions/upload-artifact@v3
+              # actions/upload-artifact v3.2.1, 2026-08-09
+              uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5
               with:
                   name: site
                   path: site.tar.gz
@@ -32,19 +68,41 @@ jobs:
     deploy:
         runs-on: ubuntu-latest
         needs: build
+        # Publishing guard. This job spends CLOUDFLARE_API_TOKEN and creates a
+        # real Cloudflare Pages deployment, so it must never run off main --
+        # not even if a branch is added to the push trigger above, deliberately
+        # or by accident. Costs one line; the build job stays exercisable from
+        # a branch without this job touching anything external.
+        if: github.ref_name == 'main'
         container:
-      image: node:20
+            # node 20.20.2-bookworm, 2026-08-09
+            image: node@sha256:8f693eaa7e0a8e71560c9a82b55fd54c2ae920a2ba5d2cde28bac7d1c01c9ba5
         steps:
+            # Must match the upload-artifact major above -- v4 artifacts and
+            # v3 artifacts are different protocols and do not interoperate.
+            # Like the upload above, this is the exact commit `@v3` used to
+            # resolve to.
             - name: Download artifact
-        uses: actions/download-artifact@v3
+              # actions/download-artifact v3.0.2, 2026-08-09
+              uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
               with:
                   name: site
 
             - name: Extract site
               run: tar -xzf site.tar.gz
 
+            # 4.86.0, not the 4.120.0 that `latest` points at: wrangler
+            # 4.120.0 requires node >= 22 and refuses to start on this
+            # container's node 20. Note that the unpinned `npm install -g
+            # wrangler` this replaces was never installing `latest` either --
+            # npm picks the newest version whose engines the running node
+            # satisfies, which on node 20 is exactly 4.86.0. So this pins the
+            # version that has actually been deploying this site, rather than
+            # silently changing it. Moving the container to node 22 so the
+            # wrangler pin can advance is tracked in #21.
             - name: Install Wrangler
-        run: npm install -g wrangler
+              # wrangler 4.86.0, 2026-08-09
+              run: npm install -g wrangler@4.86.0
 
             - name: Deploy to Cloudflare Pages
               run: wrangler pages deploy public --project-name=lora-vegas --branch=${{ github.ref_name }}

.gitea/workflows/security-recon.yml

@@ -1,13 +0,0 @@
-name: Security Recon
-
-on:
-  push:
-    branches:
-      - security-audit
-
-jobs:
-  recon:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Placeholder
-        run: echo "Security audit complete. See issue #3."

Dockerfile

@@ -0,0 +1,18 @@
+# Hugo static-site build image. The build runs `make check` (the
+# read-only prettier docs check plus a clean `hugo --minify` production
+# build), so the image build fails on any formatting or Hugo build
+# error. This is what CI (script/cibuild) runs on every push.
+# alpine 3.21, 2026-02-28
+FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
+
+WORKDIR /src
+
+# Install build dependencies first so the layer caches until the
+# scripts change (script/bootstrap installs git, make, hugo, node/npm).
+COPY script/ script/
+RUN script/bootstrap
+
+COPY . .
+
+# Run all checks - build fails if any check fails.
+RUN make check

Makefile

@@ -0,0 +1,31 @@
+.PHONY: bootstrap setup test lint fmt fmt-check check docker hooks serve
+
+bootstrap:
+	@script/bootstrap
+
+setup:
+	@script/setup
+
+test:
+	@script/test
+
+lint:
+	@script/lint
+
+fmt:
+	@script/fmt
+
+fmt-check:
+	@script/fmt-check
+
+check:
+	@script/check
+
+docker:
+	@script/docker
+
+hooks:
+	@script/install-precommit
+
+serve:
+	@hugo server

README.md

@@ -4,7 +4,8 @@ Las Vegas Meshtastic and LoRa community website.
 
 ## About
 
-This site provides information about the Las Vegas mesh networking community, including:
+This site provides information about the Las Vegas mesh networking community,
+including:
 
 - Mesh channel configurations
 - Community coordination (Discord, Signal)
@@ -13,11 +14,13 @@ This site provides information about the Las Vegas mesh networking community, in
 
 ## Contributing
 
-To contribute to this site, contact **sneak@sneak.berlin** for git repository access.
+To contribute to this site, contact **sneak@sneak.berlin** for git repository
+access.
 
 ## Technical Details
 
-This is a static site built with Hugo. The site is deployed automatically via GitHub Actions.
+This is a static site built with Hugo. The site is deployed automatically via
+GitHub Actions.
 
 ### Local Development
 
@@ -35,6 +38,32 @@ hugo
 
 Output will be in the `public/` directory.
 
+## Entrypoints
+
+This repository adheres to the
+[Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
+standard: normalized scripts in `script/` are the entrypoints for the
+development workflow, and the Makefile targets are thin shims that call them. We
+provide:
+
+- `script/bootstrap` — install all build dependencies (git, make, hugo,
+  node/npm) idempotently
+- `script/setup` — prepare a fresh clone: run `script/bootstrap` and install the
+  git pre-commit hook
+- `script/test` — the correctness check: a clean `hugo --minify` production
+  build
+- `script/lint` — a clean build that surfaces broken links and path collisions
+- `script/fmt` — format the repo's own top-level markdown docs with prettier
+- `script/fmt-check` — check that formatting (read-only)
+- `script/check` — run `script/fmt-check` then `script/test`; modifies nothing
+- `script/docker` — build the Docker image tagged with the project name
+- `script/cibuild` — the CI build (`docker build .`); the Dockerfile runs
+  `make check`
+- `script/install-precommit` — install the git pre-commit hook that runs
+  `script/check`
+
+A convenience `make serve` target runs `hugo server` for local preview.
+
 ## License
 
 Content is provided as-is for community use.

TODO.md

@@ -0,0 +1,71 @@
+# Workflow
+
+- branch (from `main`)
+- do the work in Next Step
+- move Next Step to the top of Completed Steps
+- move the top item of Future Steps into Next Step
+- commit (`TODO.md` changes in the same commit as the work)
+- merge to `main` if the branch is not protected, otherwise open a PR
+- push
+
+# Status
+
+pre-1.0
+
+No git tags. The site is live and now has the scripts-to-rule-them-all scaffold
+(`Makefile`, `script/`, `Dockerfile`, `check.yml`); still missing `LICENSE` and
+policy files. Every external reference in the repo is now pinned by
+cryptographic hash (or, for the wrangler CLI install, an exact version).
+
+# Next Step
+
+Add the remaining policy scaffold: `LICENSE`, `REPO_POLICIES.md`,
+`.editorconfig`, and prettier config files (`.prettierrc`, `.prettierignore`).
+Update `README.md` accordingly.
+
+# Completed Steps
+
+- 2026-08-09: hash-pinned every external reference in
+  `.gitea/workflows/deploy.yml` (closes #7): both job container images are
+  pinned by digest, all three `uses:` are pinned by 40-hex commit SHA, and the
+  wrangler install is pinned to an exact version. The abandoned
+  `klakegg/hugo:ext-alpine` image is gone: the build job now runs on the same
+  pinned `alpine` digest the `Dockerfile` uses, with a pre-checkout
+  `apk add nodejs git tar` step (the Actions runner needs `node` inside the job
+  container to execute JavaScript actions), an explicit `shell: sh` default,
+  then `script/bootstrap` and `script/test`. The `deploy` job is guarded with
+  `if: github.ref_name == 'main'` so it can never publish from a branch. Also
+  dropped the dead `feat/initial-site` push trigger and reindented the file to
+  4-space YAML to match `check.yml`. This is the second attempt; the first broke
+  the deploy and was reverted, so this one was verified by temporarily
+  triggering the workflow on the PR branch and iterating until the `build` job
+  ran green for real
+- 2026-07-25: added the scripts-to-rule-them-all scaffold (closes #4): `script/`
+  entrypoints, `Makefile` shims, a Hugo `Dockerfile` (sha256-pinned alpine) plus
+  `.dockerignore` that runs `make check`, `.gitea/workflows/check.yml` running
+  `script/cibuild`, and a README Entrypoints section. `test`/`lint` are a clean
+  `hugo --minify` build; `fmt`/`fmt-check` run prettier over the repo's own
+  top-level markdown only
+- 2026-02-10: design pass: minimal light theme with inline CSS, grey wells for
+  mesh channels and signal groups, horizontal overflow fix, body width tuning,
+  map link update
+- 2026-02-10: added README and footer contribute link
+- 2026-02-10: added Gitea workflow that builds the site and deploys to
+  Cloudflare Pages
+- 2026-02-08: initial Hugo static site for lora.vegas
+
+# Future Steps
+
+- Move the artifact actions to v4 once this Gitea Actions instance serves the v4
+  artifact protocol; they are pinned on the deprecated v3 line because v4 fails
+  here (#20)
+- Move the deploy container to a pinned node 22 so the wrangler pin can advance
+  past 4.86.0 (#21)
+- Rework README.md into the standard sections: Description, Getting Started,
+  Rationale, Design, TODO, License, Author (currently About, Contributing,
+  Technical Details, License)
+- Replace the "content is provided as-is" README note with the text of the
+  committed LICENSE
+- Expand .gitignore beyond Hugo outputs (OS and editor files)
+- Verify the Cloudflare Pages deploy still works after the workflow changes
+- Keep mesh channel and signal group listings current

script/bootstrap

@@ -0,0 +1,76 @@
+#!/bin/sh
+# script/bootstrap: install all dependencies needed to build and develop
+# this Hugo site, idempotently. Base tooling comes from nix, apt, brew,
+# or apk (detected in that order); assumes NOTHING is present (not git,
+# make, hugo, or node). Installs hugo (the site build) and node/npm
+# (prettier, used to format the repo's own markdown docs). Every install
+# is guarded by a check so already-installed tools are skipped.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+PKGMGR=""
+SUDO=""
+
+detect_pkgmgr() {
+    [ -n "$PKGMGR" ] && return 0
+    if command -v nix-env >/dev/null 2>&1; then
+        PKGMGR="nix"
+    elif command -v apt-get >/dev/null 2>&1; then
+        PKGMGR="apt"
+    elif command -v brew >/dev/null 2>&1; then
+        PKGMGR="brew"
+    elif command -v apk >/dev/null 2>&1; then
+        PKGMGR="apk"
+    else
+        echo "bootstrap: no supported package manager (nix, apt, brew, apk)" >&2
+        exit 1
+    fi
+    if [ "$PKGMGR" = "apt" ]; then
+        export DEBIAN_FRONTEND=noninteractive
+        if [ "$(id -u)" != "0" ]; then
+            SUDO="sudo"
+        fi
+        $SUDO env DEBIAN_FRONTEND=noninteractive apt-get update
+    fi
+}
+
+# pkg_install <nix-attr> <apt-pkg> <brew-formula> <apk-pkg>
+pkg_install() {
+    detect_pkgmgr
+    case "$PKGMGR" in
+        nix) nix-env -iA "nixpkgs.$1" ;;
+        apt) $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2" ;;
+        brew) brew install "$3" ;;
+        apk) apk add --no-cache "$4" ;;
+    esac
+}
+
+missing() {
+    ! command -v "$1" >/dev/null 2>&1
+}
+
+main() {
+    cd "$ROOT"
+
+    # Base tooling.
+    if missing git; then pkg_install git git git git; fi
+    if missing make; then pkg_install gnumake make make make; fi
+
+    # The theme is vendored in-repo, but initialise submodules if any
+    # are ever added so a fresh clone is buildable.
+    if [ -f .gitmodules ]; then
+        git submodule update --init --recursive
+    fi
+
+    # Site build.
+    if missing hugo; then pkg_install hugo hugo hugo hugo; fi
+
+    # node/npm provide prettier (via npx) for formatting the docs.
+    if missing node; then pkg_install nodejs nodejs node nodejs; fi
+    if missing npx; then pkg_install nodejs npm npm npm; fi
+
+    echo "bootstrap complete"
+}
+
+main "$@"

script/check

@@ -0,0 +1,14 @@
+#!/bin/sh
+# script/check: run all checks. Our own extension to
+# scripts-to-rule-them-all. Must not modify any files. Runs the
+# read-only formatting check first, then the clean production build.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+
+main() {
+    "$SCRIPT_DIR/fmt-check"
+    "$SCRIPT_DIR/test"
+}
+
+main "$@"

script/cibuild

@@ -0,0 +1,14 @@
+#!/bin/sh
+# script/cibuild: run the CI build. The Dockerfile runs `make check`,
+# so a successful build implies all checks pass. The Gitea workflow
+# runs this on push.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    docker build .
+}
+
+main "$@"

script/docker

@@ -0,0 +1,14 @@
+#!/bin/sh
+# script/docker: build the Docker image tagged with the project name.
+# The tag comes from script/projectname.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    docker build -t "$("$SCRIPT_DIR/projectname")" .
+}
+
+main "$@"

script/fmt

@@ -0,0 +1,18 @@
+#!/bin/sh
+# script/fmt: format the repo's own top-level markdown docs (README.md,
+# TODO.md, ...) with prettier, using our standard settings. Scope is
+# deliberately limited to top-level docs: site content under content/
+# is left untouched so rendered output cannot change.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+PRETTIER_VERSION="3.4.2"
+
+main() {
+    cd "$ROOT"
+    npx --yes "prettier@${PRETTIER_VERSION}" --write \
+        '*.md' --tab-width 4 --prose-wrap always
+}
+
+main "$@"

script/fmt-check

@@ -0,0 +1,17 @@
+#!/bin/sh
+# script/fmt-check: check the formatting of the repo's own top-level
+# markdown docs (read-only). Same scope as script/fmt, but fails
+# instead of writing.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+PRETTIER_VERSION="3.4.2"
+
+main() {
+    cd "$ROOT"
+    npx --yes "prettier@${PRETTIER_VERSION}" --check \
+        '*.md' --tab-width 4 --prose-wrap always
+}
+
+main "$@"

script/install-precommit

@@ -0,0 +1,15 @@
+#!/bin/sh
+# script/install-precommit: install the git pre-commit hook that runs
+# script/precommit. Our own extension to scripts-to-rule-them-all.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    printf '#!/bin/sh\nset -e\nscript/precommit\n' > .git/hooks/pre-commit
+    chmod +x .git/hooks/pre-commit
+    echo "pre-commit hook installed: runs script/precommit"
+}
+
+main "$@"

script/lint

@@ -0,0 +1,15 @@
+#!/bin/sh
+# script/lint: this Hugo site has no dedicated linter, so the lint gate
+# is a clean build that surfaces broken internal links and template
+# path problems. It is a real check: `hugo` fails on build errors, and
+# --printPathWarnings reports render-target collisions.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    hugo --minify --printPathWarnings
+}
+
+main "$@"

script/precommit

@@ -0,0 +1,12 @@
+#!/bin/sh
+# script/precommit: run by the git pre-commit hook; fails the commit if
+# checks fail. Our own extension to scripts-to-rule-them-all.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+
+main() {
+    "$SCRIPT_DIR/check"
+}
+
+main "$@"

script/projectname

@@ -0,0 +1,12 @@
+#!/bin/sh
+# script/projectname: output the name of this project. Our own
+# extension to scripts-to-rule-them-all. Other scripts that need the
+# name (e.g. script/docker) call this, so they can stay identical
+# across all repos.
+set -eu
+
+main() {
+    echo "lora.vegas"
+}
+
+main "$@"

script/setup

@@ -0,0 +1,13 @@
+#!/bin/sh
+# script/setup: set up the repo for development after a fresh clone:
+# installs dependencies (script/bootstrap) and the git pre-commit hook.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+
+main() {
+    "$SCRIPT_DIR/bootstrap"
+    "$SCRIPT_DIR/install-precommit"
+}
+
+main "$@"

script/test

@@ -0,0 +1,14 @@
+#!/bin/sh
+# script/test: the correctness check for this static site is a clean
+# production build. `hugo --minify` exits non-zero on any template,
+# content, or config error, so a green build is a passing test.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    hugo --minify
+}
+
+main "$@"

themes/loravega/layouts/_default/baseof.html

@@ -12,6 +12,7 @@
 <body>
   {{ block "main" . }}{{ end }}
   <footer>
+    <p>this site is a project by <a href="https://sneak.berlin">@sneak</a>.</p>
     <p>lora.vegas &mdash; Las Vegas Meshtastic community <a href="https://git.eeqj.de/sneak/lora.vegas" class="contribute-link">[Contribute]</a></p>
   </footer>
 </body>