Expand description
Guards .forgejo/scripts/deploy.sh’s Job rendering.
That script writes a Kubernetes Job whose init container runs a shell script,
and it does so from an UNQUOTED <<EOF heredoc — so the outer shell expands
the inner script before kubectl ever sees it. Nothing in the text looks
dangerous while you read it, which is exactly the problem: a backtick in a
comment becomes a command, and $1 becomes deploy.sh’s own argument.
Both mistakes shipped. The first killed the deploy at the heredoc under
set -u before any Job existed, which is why there were no logs to read.
Reading the script cannot catch this; rendering it can.
So this renders it the way production does — with kubectl and git shims
on PATH — and checks what actually comes out.