Pin checksummed Hugo download in shared workflow
All checks were successful
Publish Hugo Deployment Image / publish (push) Successful in 54s

The deploy job downloads Hugo Extended 0.165.0 from the GitHub release,
verifies its SHA-256 and runs it from RUNNER_TEMP instead of the runner's
auto-refreshing snap. Deploys fail before rsync if hugo is a different
version, not Extended, or not the pinned binary.
This commit is contained in:
Neil Borromeo 2026-10-19 15:48:34 +08:00
commit 366b448bb0

View file

@ -1,6 +1,6 @@
FROM debian:bookworm-slim
ARG HUGO_VERSION=0.160.0
ARG HUGO_VERSION=0.165.0
RUN apt-get update \
&& apt-get install -y --no-install-recommends \