updated the Pages artifact safer and more deterministic

.github/workflows/pages.yml

@@ -65,6 +65,17 @@ jobs:
           cmp install.sh _site/install.sh
           cmp install.ps1 _site/install.ps1
 
+      - name: Verify Pages artifact shape
+        shell: bash
+        run: |
+          test -s _site/index.html
+          executable_files="$(find _site -type f \( -perm -100 -o -perm -010 -o -perm -001 \))"
+          if [ -n "$executable_files" ]; then
+            echo "Pages artifact contains executable files:" >&2
+            printf '%s\n' "$executable_files" >&2
+            exit 1
+          fi
+
       - name: Upload Pages artifact
         uses: actions/upload-pages-artifact@v3
         with:

scripts/prepare-pages-site.py

@@ -18,7 +18,8 @@
 import hashlib
 import os
 import shutil
-from datetime import UTC, datetime
+import stat
+from datetime import datetime, timezone
 from pathlib import Path
 
 
@@ -110,6 +111,7 @@ def copy_installers(repo_root: Path, site: Path) -> dict[str, str]:
             raise FileNotFoundError(f"installer not found: {source}")
         target.parent.mkdir(parents=True, exist_ok=True)
         shutil.copy2(source, target)
+        target.chmod(stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP | stat.S_IROTH)
         metadata[key] = sha256(source)
     return metadata
 
@@ -118,7 +120,7 @@ def write_installer_metadata(site: Path, metadata: dict[str, str]) -> None:
     values = {
         **metadata,
         "GITHUB_SHA": os.environ.get("GITHUB_SHA", "").strip() or "local",
-        "PUBLISHED_AT": datetime.now(UTC).replace(microsecond=0).isoformat().replace("+00:00", "Z"),
+        "PUBLISHED_AT": datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z"),
     }
     body = "".join(f"{key}={value}\n" for key, value in sorted(values.items()))
     (site / "installers.env").write_text(body, encoding="utf-8")