ci: Lighthouse CI budgets on PRs — perf / a11y / SEO / best-practices… #20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Hugo site to Pages | |
| on: | |
| push: | |
| branches: [main] | |
| # Daily rebuild so the project version badges track the latest pithead / | |
| # rigforge releases without waiting for a manual push. | |
| schedule: | |
| - cron: "17 6 * * *" | |
| workflow_dispatch: | |
| # Least-privilege floor: the build job only reads the tree. Only the deploy job | |
| # needs pages:write + id-token:write, scoped to it below. (zizmor: excessive-permissions) | |
| permissions: | |
| contents: read | |
| # Allow one concurrent deployment; don't cancel an in-progress production deploy. | |
| concurrency: | |
| group: pages | |
| cancel-in-progress: false | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| env: | |
| HUGO_VERSION: 0.162.1 | |
| steps: | |
| - name: Install Hugo CLI | |
| run: | | |
| wget -O ${{ runner.temp }}/hugo.deb \ | |
| https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-amd64.deb \ | |
| && sudo dpkg -i ${{ runner.temp }}/hugo.deb | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| submodules: recursive | |
| fetch-depth: 0 | |
| persist-credentials: false # zizmor: artipacked | |
| - name: Setup Pages | |
| id: pages | |
| uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 | |
| with: | |
| enablement: true | |
| - name: Refresh release versions (best-effort) | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: python3 scripts/refresh-releases.py | |
| - name: Build with Hugo | |
| env: | |
| HUGO_ENVIRONMENT: production | |
| TZ: UTC | |
| # Pass the Pages URL through env rather than expanding it inline in the | |
| # script (avoids template-injection; zizmor: template-injection). | |
| BASE_URL: ${{ steps.pages.outputs.base_url }} | |
| run: | | |
| hugo \ | |
| --gc \ | |
| --minify \ | |
| --baseURL "${BASE_URL}/" | |
| - name: Upload artifact | |
| uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 | |
| with: | |
| path: ./public | |
| deploy: | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| runs-on: ubuntu-latest | |
| needs: build | |
| # Only this job touches Pages — grant the write scopes here, not repo-wide. | |
| permissions: | |
| pages: write | |
| id-token: write | |
| steps: | |
| - name: Deploy to GitHub Pages | |
| id: deployment | |
| uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 |