fix: use deploy-owned staging temp paths

Create staging mutation payloads in randomized deploy-owned temporary directories so migration and deployment do not require writes under the protected application root.

.gitea/workflows/deploy-staging.yml

@@ -83,13 +83,14 @@ jobs:
           ssh_root="${RUNNER_TEMP}/staging-ssh"
           key_path="$ssh_root/id_ed25519"
           known_hosts_path="$ssh_root/known_hosts"
-          incoming="$DEPLOY_PATH/.incoming/${GITEA_RUN_ID:?}-${GITEA_RUN_ATTEMPT:-1}"
           install -m 700 -d "$ssh_root"
           printf '%s\n' "$SSH_PRIVATE_KEY" | tr -d '\r' > "$key_path"
           printf '%s\n' "$STAGING_KNOWN_HOSTS" | tr -d '\r' > "$known_hosts_path"
           chmod 600 "$key_path" "$known_hosts_path"
           ssh_options=(-i "$key_path" -p "$DEPLOY_PORT" -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o "UserKnownHostsFile=$known_hosts_path")
           remote="$DEPLOY_USER@$DEPLOY_HOST"
+          incoming="$(ssh "${ssh_options[@]}" "$remote" "mktemp -d /tmp/jyotisha-staging.XXXXXXXXXX")"
+          [[ "$incoming" == /tmp/jyotisha-staging.* ]]
           cleanup() { ssh "${ssh_options[@]}" "$remote" "DOCKER_CONFIG='$incoming/.docker' docker logout '$REGISTRY_HOST' >/dev/null 2>&1 || true; rm -rf -- '$incoming'" >/dev/null 2>&1 || true; docker logout "$REGISTRY_HOST" >/dev/null 2>&1 || true; rm -rf -- "$ssh_root"; }
           trap cleanup EXIT
           ssh "${ssh_options[@]}" "$remote" "install -d -m 700 '$incoming/.docker'"

.gitea/workflows/migrate-staging-database.yml

@@ -69,13 +69,14 @@ jobs:
           ssh_root="${RUNNER_TEMP}/staging-migration-ssh"
           key_path="$ssh_root/id_ed25519"
           known_hosts_path="$ssh_root/known_hosts"
-          incoming="$DEPLOY_PATH/.incoming/${GITEA_RUN_ID:?}-${GITEA_RUN_ATTEMPT:-1}"
           install -m 700 -d "$ssh_root"
           printf '%s\n' "$SSH_PRIVATE_KEY" | tr -d '\r' > "$key_path"
           printf '%s\n' "$STAGING_KNOWN_HOSTS" | tr -d '\r' > "$known_hosts_path"
           chmod 600 "$key_path" "$known_hosts_path"
           ssh_options=(-i "$key_path" -p "$DEPLOY_PORT" -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o "UserKnownHostsFile=$known_hosts_path")
           remote="$DEPLOY_USER@$DEPLOY_HOST"
+          incoming="$(ssh "${ssh_options[@]}" "$remote" "mktemp -d /tmp/jyotisha-staging.XXXXXXXXXX")"
+          [[ "$incoming" == /tmp/jyotisha-staging.* ]]
           cleanup() { ssh "${ssh_options[@]}" "$remote" "DOCKER_CONFIG='$incoming/.docker' docker logout '$REGISTRY_HOST' >/dev/null 2>&1 || true; rm -rf -- '$incoming'" >/dev/null 2>&1 || true; docker logout "$REGISTRY_HOST" >/dev/null 2>&1 || true; rm -rf -- "$ssh_root"; }
           trap cleanup EXIT
           ssh "${ssh_options[@]}" "$remote" "install -d -m 700 '$incoming/.docker'"

deploy/run-staging-deploy.sh

@@ -29,7 +29,7 @@ if [ "$ALLOW_ROLLBACK" != "true" ] && [ "$ALLOW_ROLLBACK" != "false" ]; then
   exit 1
 fi
 case "$INCOMING_PATH" in
-  "$DEPLOY_PATH"/.incoming/*) ;;
+  /tmp/jyotisha-staging.*) ;;
   *) echo "unsafe incoming staging path" >&2; exit 1 ;;
 esac
 

deploy/run-staging-migration.sh

@@ -23,7 +23,7 @@ image_pattern='^crpi-d1feco6itet73spp\.cn-hongkong\.personal\.cr\.aliyuncs\.com/
   exit 1
 }
 case "$INCOMING_PATH" in
-  "$DEPLOY_PATH"/.incoming/*) ;;
+  /tmp/jyotisha-staging.*) ;;
   *) echo "unsafe incoming staging path" >&2; exit 1 ;;
 esac
 

frontend/tests/staging-backend-workflows.test.ts

@@ -220,11 +220,15 @@ test("Gitea staging digest resolution selects linux amd64 from manifest arrays",
   }
 });
 
-test("Gitea staging mutations use available run identifiers", () => {
+test("Gitea staging mutations use deploy-owned temporary paths", () => {
   for (const workflow of [read(giteaDeployWorkflow), read(giteaMigrationWorkflow)]) {
-    assert.match(workflow, /\$\{GITEA_RUN_ID:\?\}-\$\{GITEA_RUN_ATTEMPT:-1\}/);
+    assert.match(workflow, /mktemp -d \/tmp\/jyotisha-staging\.XXXXXXXXXX/);
+    assert.match(workflow, /\[\[ "\$incoming" == \/tmp\/jyotisha-staging\.\* \]\]/);
     assert.doesNotMatch(workflow, /GITEA_RUN_NUMBER/);
   }
+  for (const script of [read(deployScript), read(migrationScript)]) {
+    assert.match(script, /\/tmp\/jyotisha-staging\.\*\) ;;/);
+  }
 });
 
 test("staging mutations retain every pending deployment and migration", () => {