Add shared Hugo deployment workflows

.forgejo/workflows/deploy-hugo-site.yml

@@ -0,0 +1,105 @@
+name: Deploy Hugo Site
+
+on:
+  workflow_call:
+    inputs:
+      workflow_name:
+        description: Display name for the caller workflow
+        required: false
+        default: Deploy
+        type: string
+      checkout_submodules:
+        description: Whether checkout should fetch submodules recursively
+        required: false
+        default: false
+        type: boolean
+      deploy_script:
+        description: Path to the repo-local deploy script
+        required: false
+        default: ./scripts/deploy.sh
+        type: string
+      deploy_ssh_host:
+        description: Deployment SSH host
+        required: false
+        default: ""
+        type: string
+      deploy_ssh_user:
+        description: Deployment SSH user
+        required: false
+        default: ""
+        type: string
+    secrets:
+      deploy_ssh_key:
+        required: true
+
+jobs:
+  deploy:
+    name: ${{ inputs.workflow_name }}
+    timeout-minutes: 20
+    runs-on: docker-desktop
+    container:
+      image: registry.develton.com/cliper/hugo-deployment:v1
+    defaults:
+      run:
+        shell: bash
+    env:
+      DEPLOY_SSH_HOST: ${{ inputs.deploy_ssh_host != '' && inputs.deploy_ssh_host || vars.DEPLOY_SSH_HOST }}
+      DEPLOY_SSH_PORT: ${{ vars.DEPLOY_SSH_PORT }}
+      DEPLOY_SSH_USER: ${{ inputs.deploy_ssh_user != '' && inputs.deploy_ssh_user || vars.DEPLOY_SSH_USER }}
+      DEPLOY_KNOWN_HOSTS: ${{ vars.DEPLOY_KNOWN_HOSTS }}
+      DEPLOY_PATH: ${{ vars.DEPLOY_PATH }}
+      HUGO_PARAMS_ANALYTICS_GOOGLE_SITEVERIFICATIONTAG: ${{ vars.GOOGLE_SITE_VERIFICATION_TAG }}
+      HUGO_PARAMS_TURNSTILESITEKEY: ${{ vars.TURNSTILE_SITE_KEY }}
+      HUGO_WORKER_URL: ${{ vars.WORKER_URL }}
+    steps:
+      - name: Checkout repository
+        uses: https://data.forgejo.org/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          submodules: ${{ inputs.checkout_submodules && 'recursive' || 'false' }}
+
+      - name: Validate deploy configuration
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.deploy_ssh_key }}
+        run: |
+          set -euo pipefail
+          missing=()
+          [[ -n "${DEPLOY_SSH_HOST:-}" ]] || missing+=("DEPLOY_SSH_HOST")
+          [[ -n "${DEPLOY_SSH_USER:-}" ]] || missing+=("DEPLOY_SSH_USER")
+          [[ -n "${DEPLOY_PATH:-}" ]] || missing+=("DEPLOY_PATH")
+          [[ -n "${DEPLOY_SSH_KEY:-}" ]] || missing+=("DEPLOY_SSH_KEY")
+          if (( ${#missing[@]} > 0 )); then
+            printf 'Missing required deploy settings: %s\n' "${missing[*]}" >&2
+            exit 1
+          fi
+
+      - name: Write deploy key
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.deploy_ssh_key }}
+        run: |
+          set -euo pipefail
+          install -d -m 0700 "$HOME/.ssh"
+          printf '%s\n' "$DEPLOY_SSH_KEY" > "$HOME/.ssh/deploy_key"
+          chmod 0600 "$HOME/.ssh/deploy_key"
+
+      - name: Add deploy host to known_hosts
+        run: |
+          set -euo pipefail
+          install -d -m 0700 "$HOME/.ssh"
+          if [[ -n "${DEPLOY_KNOWN_HOSTS:-}" ]]; then
+            printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
+          else
+            ssh-keyscan -H -p "${DEPLOY_SSH_PORT:-22}" "${DEPLOY_SSH_HOST}" > "$HOME/.ssh/known_hosts"
+          fi
+          chmod 0600 "$HOME/.ssh/known_hosts"
+
+      - name: Run deploy script
+        run: |
+          set -euo pipefail
+          test -x "${{ inputs.deploy_script }}" || chmod +x "${{ inputs.deploy_script }}"
+          export SSH_IDENTITY_FILE="$HOME/.ssh/deploy_key"
+          export SSH_KNOWN_HOSTS_FILE="$HOME/.ssh/known_hosts"
+          "${{ inputs.deploy_script }}"
+
+      - name: Remove deploy key
+        if: ${{ always() }}
+        run: rm -f "$HOME/.ssh/deploy_key"