Expand description
Guards .forgejo/scripts/deploy.sh’s handoff to ci-image.
History, because it explains the shape of these tests. deploy.sh used to render a kaniko Job
itself, from an UNQUOTED <<EOF heredoc — so the outer shell expanded the inner script before
kubectl ever saw it. Nothing in the text looked dangerous while you read it, which was exactly
the problem: a backtick in a comment became a command, and $1 became deploy.sh’s own
argument. Both mistakes shipped, and the first killed the deploy at the heredoc under set -u
before any Job existed — which is why there were no logs to read.
The Job is now rendered by ci-image (do-k8s apps/ci/runner-image/ci-image-build.sh), which
carries its own manifest-rendering tests. What is left here is the half this repo owns: the
prepare script, and whether it reaches ci-image intact. It travels as a QUOTED heredoc into an
env value, so the outer shell no longer expands anything — but that is a property worth
asserting rather than assuming, since unquoting the heredoc would silently restore the old
hazard.
So this runs deploy.sh with a ci-image shim on PATH and checks what it was actually handed.