Pin checksummed Hugo download in shared workflow

The deploy job downloads Hugo Extended 0.165.0 from the GitHub release,
verifies its SHA-256 and runs it from RUNNER_TEMP instead of the runner's
auto-refreshing snap. Deploys fail before rsync if hugo is a different
version, not Extended, or not the pinned binary.

.forgejo/workflows/deploy-hugo-site.yml

@@ -38,7 +38,9 @@ jobs:
       run:
         shell: bash
     env:
-      PATH: /snap/hugo/current/bin:/usr/local/bin:/usr/bin:/bin:/snap/bin
+      PATH: /usr/local/bin:/usr/bin:/bin:/snap/bin
+      HUGO_VERSION: "0.165.0"
+      HUGO_SHA256: "f43494894cdf4a8630a201d5c828051c77f523cc66bb3938b30806835470ac20"
       DEPLOY_SSH_HOST: ${{ inputs.deploy_ssh_host != '' && inputs.deploy_ssh_host || vars.DEPLOY_SSH_HOST }}
       DEPLOY_SSH_PORT: ${{ vars.DEPLOY_SSH_PORT }}
       DEPLOY_SSH_USER: ${{ inputs.deploy_ssh_user != '' && inputs.deploy_ssh_user || vars.DEPLOY_SSH_USER }}
@@ -53,6 +55,55 @@ jobs:
         with:
           submodules: ${{ inputs.checkout_submodules && 'recursive' || 'false' }}
 
+      - name: Install pinned Hugo Extended
+        run: |
+          set -euo pipefail
+          arch="$(uname -m)"
+          if [[ "$arch" != "x86_64" ]]; then
+            printf 'Unsupported runner architecture: %s\n' "$arch" >&2
+            exit 1
+          fi
+          hugo_dir="${RUNNER_TEMP:?RUNNER_TEMP is not set}/hugo-${HUGO_VERSION}"
+          archive="hugo_extended_${HUGO_VERSION}_linux-amd64.tar.gz"
+          rm -rf "$hugo_dir"
+          mkdir -p "$hugo_dir"
+          curl --fail --silent --show-error --location --retry 3 \
+            "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/${archive}" \
+            --output "$hugo_dir/$archive"
+          printf '%s  %s\n' "$HUGO_SHA256" "$hugo_dir/$archive" | sha256sum --check --strict
+          tar -xzf "$hugo_dir/$archive" -C "$hugo_dir" hugo
+          rm -f "$hugo_dir/$archive"
+          printf '%s\n' "$hugo_dir" >> "$GITHUB_PATH"
+
+      - name: Validate Hugo version
+        run: |
+          set -euo pipefail
+          expected_hugo_path="${RUNNER_TEMP:?RUNNER_TEMP is not set}/hugo-${HUGO_VERSION}/hugo"
+          actual_hugo_path="$(command -v hugo || true)"
+          if [[ "$actual_hugo_path" != "$expected_hugo_path" ]]; then
+            printf 'Expected hugo at %s, got: %s\n' "$expected_hugo_path" "${actual_hugo_path:-<none>}" >&2
+            exit 1
+          fi
+          if ! actual_hugo_version="$(hugo version 2>&1)"; then
+            printf 'Unable to determine Hugo version: %s\n' "$actual_hugo_version" >&2
+            exit 1
+          fi
+          read -r hugo_product hugo_version_token _ <<< "$actual_hugo_version"
+          if [[ "$hugo_product" != "hugo" || "$hugo_version_token" != v* ]]; then
+            printf 'Unable to parse Hugo version output: %s\n' "$actual_hugo_version" >&2
+            exit 1
+          fi
+          reported_hugo_version="${hugo_version_token#v}"
+          reported_hugo_version="${reported_hugo_version%%[-+]*}"
+          if [[ ! "$reported_hugo_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ || "$reported_hugo_version" != "$HUGO_VERSION" ]]; then
+            printf 'Expected Hugo v%s, got: %s\n' "$HUGO_VERSION" "$hugo_version_token" >&2
+            exit 1
+          fi
+          if [[ "$hugo_version_token" != *"+extended" ]]; then
+            printf 'Expected Hugo Extended, got: %s\n' "$hugo_version_token" >&2
+            exit 1
+          fi
+
       - name: Validate deploy configuration
         env:
           DEPLOY_SSH_KEY: ${{ secrets.deploy_ssh_key }}