Build Packwiz hashes in published images

.gitea/workflows/publish.yml

@@ -36,6 +36,17 @@ jobs:
         # explicitly ensures /dev still contains today's development branch.
         run: git fetch origin main:refs/remotes/origin/main --tags --force
 
+      - name: Set up Go for Packwiz
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.23.x"
+          cache: false
+
+      - name: Install pinned Packwiz
+        # Packwiz has no stable binary release channel. Pinning the source
+        # revision makes image builds reproducible instead of following latest.
+        run: go install github.com/packwiz/packwiz@dfd8b68a4796c763e25bad50265ea1f1233e24f1
+
       - name: Assemble static Packwiz site
         env:
           EVENT_REF: ${{ gitea.ref }}
@@ -50,8 +61,13 @@ jobs:
             refs/tags/*) dev_ref=origin/main ;;
             *)           dev_ref=$EVENT_SHA ;;
           esac
-          ./scripts/build-site.sh "$dev_ref"
+          PACKWIZ_BIN="$(go env GOPATH)/bin/packwiz" \
+            ./scripts/build-site.sh "$dev_ref"
           test -s .build/site/forever/dev/pack.toml
+          grep -q '^hash = "[0-9a-f]\{64\}"$' \
+            .build/site/forever/dev/pack.toml
+          # Building distribution metadata must not alter tracked source packs.
+          git diff --exit-code -- forever playground
 
       - name: Verify tagged release output
         if: startsWith(gitea.ref, 'refs/tags/')