deploy.yml

name: Deploy Hugo site to Pages

on:
  push:
    branches: [main]
  # Daily rebuild so the project version badges track the latest pithead /
  # rigforge releases without waiting for a manual push.
  schedule:
    - cron: "17 6 * * *"
  workflow_dispatch:

# Least-privilege floor: the build job only reads the tree. Only the deploy job
# needs pages:write + id-token:write, scoped to it below. (zizmor: excessive-permissions)
permissions:
  contents: read

# Allow one concurrent deployment; don't cancel an in-progress production deploy.
concurrency:
  group: pages
  cancel-in-progress: false

defaults:
  run:
    shell: bash

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          submodules: recursive
          fetch-depth: 0
          persist-credentials: false # zizmor: artipacked
      - name: Setup Pages
        id: pages
        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
        with:
          enablement: true
      - name: Install Hugo (extended)
        run: |
          HUGO_VERSION="$(cat .hugoversion)"   # single source of truth (see also ci.yml)
          wget -O "${{ runner.temp }}/hugo.deb" \
            "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-amd64.deb"
          sudo dpkg -i "${{ runner.temp }}/hugo.deb"
      - name: Refresh release versions (best-effort)
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: python3 scripts/refresh-releases.py
      - name: Build with Hugo
        env:
          HUGO_ENVIRONMENT: production
          TZ: UTC
          # Pass the Pages URL through env rather than expanding it inline in the
          # script (avoids template-injection; zizmor: template-injection).
          BASE_URL: ${{ steps.pages.outputs.base_url }}
        run: |
          hugo \
            --gc \
            --minify \
            --baseURL "${BASE_URL}/"
      - name: Upload artifact
        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
        with:
          path: ./public

  deploy:
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    runs-on: ubuntu-latest
    needs: build
    # Only this job touches Pages — grant the write scopes here, not repo-wide.
    permissions:
      pages: write
      id-token: write
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0