Add shared Hugo deployment workflows

README.md

@@ -0,0 +1,73 @@
+# Hugo Deployment
+
+Shared Forgejo deployment image scaffold for Develton-managed Hugo sites.
+
+## Contents
+
+- Prebuilt deployment image with Hugo, rsync, and OpenSSH client tools
+- Forgejo workflow that publishes versioned and `latest` image tags
+- Image publish path intended for `registry.develton.com`
+
+## Prerequisites
+
+- Repository must be public if other repos call the reusable workflow directly
+- Forgejo variables: `REGISTRY_HOST`, `REGISTRY_USERNAME`
+- Forgejo secrets: `REGISTRY_PASSWORD`
+- The image was smoke-tested locally, and `hugo version`, `rsync --version`, and `ssh -V` were confirmed successfully.
+
+## Sites
+
+- `neilb.com`
+- `boholtoday.com`
+- `boholcentral.com`
+- `cloud.develton.com`
+- `komsysnet.com`
+- `thefreelancemastery.com`
+
+## Image Publishing
+
+The publish workflow runs on `docker-desktop` and publishes the versioned tag on every run.
+
+- Pushes to `main` publish `registry.develton.com/cliper/hugo-deployment:<commit-sha>` and also move `latest`
+- Manual runs can override the tag with `image_tag`
+- Manual runs do not move `latest` unless `publish_latest` is set to `true`
+
+It pushes:
+
+- `registry.develton.com/cliper/hugo-deployment:<tag>`
+- `registry.develton.com/cliper/hugo-deployment:latest`
+
+Required variables and secrets:
+
+- `REGISTRY_HOST`
+- `REGISTRY_USERNAME`
+- `REGISTRY_PASSWORD`
+
+Workflow inputs:
+
+- `image_tag`
+- `publish_latest`
+
+## Reusable Workflow
+
+Site repos call the shared workflow with:
+
+```yaml
+jobs:
+  deploy:
+    uses: cliper/hugo_deployment/.forgejo/workflows/deploy-hugo-site.yml@v1
+    with:
+      deploy_script: ./scripts/deploy.sh
+    secrets:
+      deploy_ssh_key: ${{ secrets.DEPLOY_SSH_KEY }}
+```
+
+Notes:
+
+- For the current caller pattern, `DEPLOY_SSH_HOST`, `DEPLOY_SSH_USER`, and `DEPLOY_PATH` are required repo variables unless the caller explicitly passes host and user as workflow inputs
+- Caller repos can set `DEPLOY_KNOWN_HOSTS` in repo variables with a pinned `known_hosts` entry for stronger host verification
+- If `DEPLOY_KNOWN_HOSTS` is not set, the workflow falls back to `ssh-keyscan` so current repos keep working
+- The reusable workflow itself always runs on `docker-desktop`
+- The reusable workflow resolves its container image as `registry.develton.com/cliper/hugo-deployment:v1`, so caller repos do not need `REGISTRY_HOST` just to start the job
+- Because the reusable workflow job container is resolved before checkout, callers must not switch over until `registry.develton.com/cliper/hugo-deployment:v1` has been published and verified pullable by the runner
+- The reusable workflow is currently pinned to `registry.develton.com/cliper/hugo-deployment:v1`