From ef7b312d7e89df8fafec84a5b5d8209657fe80f2 Mon Sep 17 00:00:00 2001
From: "Hermes (agora)" <hermes.frangoudis@agora.io>
Date: Mon, 6 Jul 2026 14:20:03 +0300
Subject: [PATCH] updated the Pages artifact safer and more deterministic

---
 .github/workflows/pages.yml   | 11 +++++++++++
 scripts/prepare-pages-site.py |  6 ++++--
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index efa0c4c..49bf1a1 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -65,6 +65,17 @@ jobs:
           cmp install.sh _site/install.sh
           cmp install.ps1 _site/install.ps1
 
+      - name: Verify Pages artifact shape
+        shell: bash
+        run: |
+          test -s _site/index.html
+          executable_files="$(find _site -type f \( -perm -100 -o -perm -010 -o -perm -001 \))"
+          if [ -n "$executable_files" ]; then
+            echo "Pages artifact contains executable files:" >&2
+            printf '%s\n' "$executable_files" >&2
+            exit 1
+          fi
+
       - name: Upload Pages artifact
         uses: actions/upload-pages-artifact@v3
         with:
diff --git a/scripts/prepare-pages-site.py b/scripts/prepare-pages-site.py
index c2a1a62..c35a982 100644
--- a/scripts/prepare-pages-site.py
+++ b/scripts/prepare-pages-site.py
@@ -18,7 +18,8 @@
 import hashlib
 import os
 import shutil
-from datetime import UTC, datetime
+import stat
+from datetime import datetime, timezone
 from pathlib import Path
 
 
@@ -110,6 +111,7 @@ def copy_installers(repo_root: Path, site: Path) -> dict[str, str]:
             raise FileNotFoundError(f"installer not found: {source}")
         target.parent.mkdir(parents=True, exist_ok=True)
         shutil.copy2(source, target)
+        target.chmod(stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP | stat.S_IROTH)
         metadata[key] = sha256(source)
     return metadata
 
@@ -118,7 +120,7 @@ def write_installer_metadata(site: Path, metadata: dict[str, str]) -> None:
     values = {
         **metadata,
         "GITHUB_SHA": os.environ.get("GITHUB_SHA", "").strip() or "local",
-        "PUBLISHED_AT": datetime.now(UTC).replace(microsecond=0).isoformat().replace("+00:00", "Z"),
+        "PUBLISHED_AT": datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z"),
     }
     body = "".join(f"{key}={value}\n" for key, value in sorted(values.items()))
     (site / "installers.env").write_text(body, encoding="utf-8")