The former is correct, as verified by RFC 2986: PKCS #10: Certification Request Syntax Specification:
The process by which a certification request is constructed involves
the following steps:
1. A CertificationRequestInfo value containing a subject
distinguished name, a subject public key, and optionally a
set of attributes is constructed by an entity requesting
certification.
2. The CertificationRequestInfo value is signed with the subject
entity's private key. (See Section 4.2.)
3. The CertificationRequestInfo value, a signature algorithm
identifier, and the entity's signature are collected together
into a CertificationRequest value, defined below.
Paraphrasing: the public key of the subject (the requester of a certificate) is included verbatim in the CSR. It is not "computed" by the CA, but it is used to verify the signature of the CSR (to ensure that it was indeed requested by the holder of the key pair and not tampered with).
As for the DigiCert article: it goes on to state:
the SSL certificate itself is sometimes referred to as "the public
key."
This would explain their use of "public key" instead of "certificate". As you noticed, this only brings confusion to an article supposed to explain the use of key pairs.