366b448bb0
All checks were successful
Publish Hugo Deployment Image / publish (push) Successful in 54s
The deploy job downloads Hugo Extended 0.165.0 from the GitHub release, verifies its SHA-256 and runs it from RUNNER_TEMP instead of the runner's auto-refreshing snap. Deploys fail before rsync if hugo is a different version, not Extended, or not the pinned binary.
29 lines
1.2 KiB
Docker
29 lines
1.2 KiB
Docker
FROM debian:bookworm-slim
|
|
|
|
ARG HUGO_VERSION=0.165.0
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
curl \
|
|
git \
|
|
nodejs \
|
|
rsync \
|
|
openssh-client \
|
|
tar \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN case "$(dpkg --print-architecture)" in \
|
|
amd64) asset="hugo_extended_${HUGO_VERSION}_linux-amd64.tar.gz" ;; \
|
|
arm64) asset="hugo_extended_${HUGO_VERSION}_linux-arm64.tar.gz" ;; \
|
|
*) echo "Unsupported architecture: $(dpkg --print-architecture)" >&2; exit 1 ;; \
|
|
esac \
|
|
&& curl -fsSLo /tmp/hugo-checksums.txt "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_${HUGO_VERSION}_checksums.txt" \
|
|
&& curl -fsSLo /tmp/hugo.tar.gz "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/${asset}" \
|
|
&& grep " ${asset}$" /tmp/hugo-checksums.txt | sed 's# .*# /tmp/hugo.tar.gz#' > /tmp/hugo.tar.gz.sha256 \
|
|
&& sha256sum -c /tmp/hugo.tar.gz.sha256 \
|
|
&& tar -xzf /tmp/hugo.tar.gz -C /tmp hugo \
|
|
&& install -m 0755 /tmp/hugo /usr/local/bin/hugo \
|
|
&& rm -rf /tmp/hugo /tmp/hugo.tar.gz /tmp/hugo-checksums.txt /tmp/hugo.tar.gz.sha256
|
|
|
|
WORKDIR /workspace
|