fix: honor explicit GTFS_RT_FEEDS=[] and harden renderer CI job

Address CodeRabbit review on PR #130:
- bootstrap.sh: an explicit GTFS_RT_FEEDS='[]' now disables realtime feeds
  instead of silently falling back to the legacy single-feed env vars.
  Existing deployments (legacy vars set, GTFS_RT_FEEDS unset) are unaffected;
  whitespace-only values still fall through. Also corrects the status log to
  read accurately for any feed count (0, 1, or N).
- test.yaml: add least-privilege 'permissions: contents: read' to the
  renderer job.

Author: aaronbrethorst

.github/workflows/test.yaml

@@ -10,6 +10,8 @@ jobs:
   renderer:
     name: Template renderer tests
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4

oba/bootstrap.sh

@@ -36,9 +36,12 @@ FEDERATION_XML_DESTINATION="$CATALINA_HOME/webapps/onebusaway-transit-data-feder
 # single-feed vars so already-deployed Dockerfiles keep working.
 # Strip whitespace for the guard only, so a blank/whitespace GTFS_RT_FEEDS
 # falls through to the legacy/no-feeds path instead of producing invalid JSON.
+# Any explicit (non-whitespace) value — including "[]" — takes precedence over
+# the legacy vars, so operators can disable realtime feeds with GTFS_RT_FEEDS='[]'
+# even when the legacy single-feed vars are still set.
 GTFS_RT_FEEDS_TRIMMED="$(printf '%s' "$GTFS_RT_FEEDS" | tr -d '[:space:]')"
-if [ -n "$GTFS_RT_FEEDS_TRIMMED" ] && [ "$GTFS_RT_FEEDS_TRIMMED" != "[]" ]; then
-    echo "GTFS_RT_FEEDS is set. Rendering multiple GTFS-RT feeds."
+if [ -n "$GTFS_RT_FEEDS_TRIMMED" ]; then
+    echo "GTFS_RT_FEEDS is set; using it to configure GTFS-RT feeds."
     FEEDS_JSON="$GTFS_RT_FEEDS"
 elif [ -n "$TRIP_UPDATES_URL" ] || [ -n "$VEHICLE_POSITIONS_URL" ]; then
     echo "Legacy single-feed GTFS-RT env vars are set. Normalizing into one feed."