hugo_deployment/.forgejo/workflows/deploy-hugo-site.yml

name: Deploy Hugo Site

on:
  workflow_call:
    inputs:
      workflow_name:
        description: Display name for the caller workflow
        required: false
        default: Deploy
        type: string
      checkout_submodules:
        description: Whether checkout should fetch submodules recursively
        required: false
        default: false
        type: boolean
      deploy_script:
        description: Path to the repo-local deploy script
        required: false
        default: ./scripts/deploy.sh
        type: string
      deploy_ssh_host:
        description: Deployment SSH host
        required: false
        default: ""
        type: string
      deploy_ssh_user:
        description: Deployment SSH user
        required: false
        default: ""
        type: string

jobs:
  deploy:
    name: ${{ inputs.workflow_name }}
    timeout-minutes: 20
    runs-on: develton-hugo
    defaults:
      run:
        shell: bash
    env:
      PATH: /usr/local/bin:/usr/bin:/bin:/snap/bin
      HUGO_VERSION: "0.165.0"
      HUGO_SHA256: "f43494894cdf4a8630a201d5c828051c77f523cc66bb3938b30806835470ac20"
      DEPLOY_SSH_HOST: ${{ inputs.deploy_ssh_host != '' && inputs.deploy_ssh_host || vars.DEPLOY_SSH_HOST }}
      DEPLOY_SSH_PORT: ${{ vars.DEPLOY_SSH_PORT }}
      DEPLOY_SSH_USER: ${{ inputs.deploy_ssh_user != '' && inputs.deploy_ssh_user || vars.DEPLOY_SSH_USER }}
      DEPLOY_KNOWN_HOSTS: ${{ vars.DEPLOY_KNOWN_HOSTS }}
      DEPLOY_PATH: ${{ vars.DEPLOY_PATH }}
      HUGO_PARAMS_ANALYTICS_GOOGLE_SITEVERIFICATIONTAG: ${{ vars.GOOGLE_SITE_VERIFICATION_TAG }}
      HUGO_PARAMS_TURNSTILESITEKEY: ${{ vars.TURNSTILE_SITE_KEY }}
      HUGO_WORKER_URL: ${{ vars.HUGO_WORKER_URL }}
    steps:
      - name: Checkout repository
        uses: https://data.forgejo.org/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          submodules: ${{ inputs.checkout_submodules && 'recursive' || 'false' }}

      - name: Install pinned Hugo Extended
        run: |
          set -euo pipefail
          arch="$(uname -m)"
          if [[ "$arch" != "x86_64" ]]; then
            printf 'Unsupported runner architecture: %s\n' "$arch" >&2
            exit 1
          fi
          hugo_dir="${RUNNER_TEMP:?RUNNER_TEMP is not set}/hugo-${HUGO_VERSION}"
          archive="hugo_extended_${HUGO_VERSION}_linux-amd64.tar.gz"
          rm -rf "$hugo_dir"
          mkdir -p "$hugo_dir"
          curl --fail --silent --show-error --location --retry 3 \
            "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/${archive}" \
            --output "$hugo_dir/$archive"
          printf '%s  %s\n' "$HUGO_SHA256" "$hugo_dir/$archive" | sha256sum --check --strict
          tar -xzf "$hugo_dir/$archive" -C "$hugo_dir" hugo
          rm -f "$hugo_dir/$archive"
          printf '%s\n' "$hugo_dir" >> "$GITHUB_PATH"

      - name: Validate Hugo version
        run: |
          set -euo pipefail
          expected_hugo_path="${RUNNER_TEMP:?RUNNER_TEMP is not set}/hugo-${HUGO_VERSION}/hugo"
          actual_hugo_path="$(command -v hugo || true)"
          if [[ "$actual_hugo_path" != "$expected_hugo_path" ]]; then
            printf 'Expected hugo at %s, got: %s\n' "$expected_hugo_path" "${actual_hugo_path:-<none>}" >&2
            exit 1
          fi
          if ! actual_hugo_version="$(hugo version 2>&1)"; then
            printf 'Unable to determine Hugo version: %s\n' "$actual_hugo_version" >&2
            exit 1
          fi
          read -r hugo_product hugo_version_token _ <<< "$actual_hugo_version"
          if [[ "$hugo_product" != "hugo" || "$hugo_version_token" != v* ]]; then
            printf 'Unable to parse Hugo version output: %s\n' "$actual_hugo_version" >&2
            exit 1
          fi
          reported_hugo_version="${hugo_version_token#v}"
          reported_hugo_version="${reported_hugo_version%%[-+]*}"
          if [[ ! "$reported_hugo_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ || "$reported_hugo_version" != "$HUGO_VERSION" ]]; then
            printf 'Expected Hugo v%s, got: %s\n' "$HUGO_VERSION" "$hugo_version_token" >&2
            exit 1
          fi
          if [[ "$hugo_version_token" != *"+extended" ]]; then
            printf 'Expected Hugo Extended, got: %s\n' "$hugo_version_token" >&2
            exit 1
          fi

      - name: Validate deploy configuration
        env:
          DEPLOY_SSH_KEY: ${{ secrets.deploy_ssh_key }}
        run: |
          set -euo pipefail
          missing=()
          [[ -n "${DEPLOY_SSH_HOST:-}" ]] || missing+=("DEPLOY_SSH_HOST")
          [[ -n "${DEPLOY_SSH_USER:-}" ]] || missing+=("DEPLOY_SSH_USER")
          [[ -n "${DEPLOY_PATH:-}" ]] || missing+=("DEPLOY_PATH")
          [[ -n "${DEPLOY_SSH_KEY:-}" ]] || missing+=("DEPLOY_SSH_KEY")
          if (( ${#missing[@]} > 0 )); then
            printf 'Missing required deploy settings: %s\n' "${missing[*]}" >&2
            exit 1
          fi

      - name: Write deploy key
        env:
          DEPLOY_SSH_KEY: ${{ secrets.deploy_ssh_key }}
        run: |
          set -euo pipefail
          install -d -m 0700 "$HOME/.ssh"
          printf '%s\n' "$DEPLOY_SSH_KEY" > "$HOME/.ssh/deploy_key"
          chmod 0600 "$HOME/.ssh/deploy_key"

      - name: Add deploy host to known_hosts
        run: |
          set -euo pipefail
          install -d -m 0700 "$HOME/.ssh"
          if [[ -n "${DEPLOY_KNOWN_HOSTS:-}" ]]; then
            printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
          else
            {
              ssh-keyscan -H -p "${DEPLOY_SSH_PORT:-22}" "${DEPLOY_SSH_HOST}"
              getent ahosts "${DEPLOY_SSH_HOST}" \
                | awk '{ print $1 }' \
                | sort -u \
                | xargs -r -n1 ssh-keyscan -H -p "${DEPLOY_SSH_PORT:-22}"
            } > "$HOME/.ssh/known_hosts"
          fi
          chmod 0600 "$HOME/.ssh/known_hosts"

      - name: Run deploy script
        run: |
          set -euo pipefail
          test -x "${{ inputs.deploy_script }}" || chmod +x "${{ inputs.deploy_script }}"
          export SSH_IDENTITY_FILE="$HOME/.ssh/deploy_key"
          export SSH_KNOWN_HOSTS_FILE="$HOME/.ssh/known_hosts"
          "${{ inputs.deploy_script }}"

      - name: Remove deploy key
        if: ${{ always() }}
        run: rm -f "$HOME/.ssh/deploy_key"