Build Packwiz hashes in published images

.gitea/README.md

@@ -173,8 +173,11 @@ Pterodactyl is responsible for Java, server process management and resources.
 
 Kubernetes/SWS provides static hosting for the published Packwiz repositories.
 The publishing workflow runs [`scripts/build-site.sh`](../scripts/build-site.sh),
-which exports committed Git revisions into the documented URL layout, then
-builds the multi-architecture image
+which exports committed Git revisions into the documented URL layout. Source
+packs intentionally keep `no-internal-hashes = true`; the workflow runs
+`packwiz refresh --build` only against the exported copies under `.build/site`
+so the image contains installer-ready hashes without committing generated hash
+churn. It then builds the multi-architecture image
 `tea.ahmza.com/ahmza.com/mcpacks-site`.
 
 The workflow finally commits that image's immutable OCI digest to

.gitea/workflows/publish.yml

@@ -36,6 +36,17 @@ jobs:
         # explicitly ensures /dev still contains today's development branch.
         run: git fetch origin main:refs/remotes/origin/main --tags --force
 
+      - name: Set up Go for Packwiz
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.23.x"
+          cache: false
+
+      - name: Install pinned Packwiz
+        # Packwiz has no stable binary release channel. Pinning the source
+        # revision makes image builds reproducible instead of following latest.
+        run: go install github.com/packwiz/packwiz@dfd8b68a4796c763e25bad50265ea1f1233e24f1
+
       - name: Assemble static Packwiz site
         env:
           EVENT_REF: ${{ gitea.ref }}
@@ -50,8 +61,13 @@ jobs:
             refs/tags/*) dev_ref=origin/main ;;
             *)           dev_ref=$EVENT_SHA ;;
           esac
-          ./scripts/build-site.sh "$dev_ref"
+          PACKWIZ_BIN="$(go env GOPATH)/bin/packwiz" \
+            ./scripts/build-site.sh "$dev_ref"
           test -s .build/site/forever/dev/pack.toml
+          grep -q '^hash = "[0-9a-f]\{64\}"$' \
+            .build/site/forever/dev/pack.toml
+          # Building distribution metadata must not alter tracked source packs.
+          git diff --exit-code -- forever playground
 
       - name: Verify tagged release output
         if: startsWith(gitea.ref, 'refs/tags/')