docs(build): pin the deploy tooling versions and disable install scripts

The publish workflow installed cloudron-surfer, the mkdocs pip set and
@marp-team/marp-cli with no version pins, so a breaking or compromised upstream
release would ship straight to the live site on the next merge to main.

- pin cloudron-surfer@6.4.1, mkdocs==1.6.1, mkdocs-material==9.7.7,
  fontawesome_markdown==0.2.6, mkdocs-redirects==1.2.3 and
  @marp-team/marp-cli@4.5.1 (the versions the site builds with today)
- add .npmrc with ignore-scripts=true and save-exact=true; neither npm package
  ships an install/preinstall/postinstall hook, so nothing is skipped

.gitea/workflows/publish.yml

@@ -31,19 +31,22 @@ jobs:
           apt install -y ./google-chrome*.deb;
           export CHROME_BIN=/usr/bin/google-chrome
 
+      # Deploy tooling is pinned to exact versions: the workflow builds whatever
+      # is committed, and an unpinned `latest` would let a breaking or
+      # compromised upstream release ship straight to the live site.
       - name: Install Surfer
         run: |
-          npm -g install cloudron-surfer
+          npm -g install cloudron-surfer@6.4.1
 
       - name: build site
         run: |
-          pip install mkdocs
-          pip install mkdocs-material
-          pip install fontawesome_markdown
-          pip install mkdocs-redirects
+          pip install mkdocs==1.6.1
+          pip install mkdocs-material==9.7.7
+          pip install fontawesome_markdown==0.2.6
+          pip install mkdocs-redirects==1.2.3
           mkdocs build --clean
           mkdir site/slides
-          npx @marp-team/marp-cli slides/innovation/innovation.md -o ./site/slides/innovation/index.html
-          npx @marp-team/marp-cli slides/if/if.md -o site/if.pdf --allow-local-files --html=true
+          npx @marp-team/marp-cli@4.5.1 slides/innovation/innovation.md -o ./site/slides/innovation/index.html
+          npx @marp-team/marp-cli@4.5.1 slides/if/if.md -o site/if.pdf --allow-local-files --html=true
       - name: Deploy docs
         run: surfer put --token ${{ secrets.SURFERKEY }} --server docs.datacontroller.io site/* /

.npmrc

@@ -0,0 +1,11 @@
+# npm configuration for this repo's CI and local installs.
+#
+# ignore-scripts keeps package install scripts (an arbitrary-code execution
+# point) from running during the deploy workflow. Both npm packages the
+# workflow installs - cloudron-surfer and @marp-team/marp-cli - ship no
+# install, preinstall or postinstall hook, so nothing is skipped.
+#
+# save-exact pins anything installed from here to an exact version rather than
+# a caret range.
+ignore-scripts=true
+save-exact=true