Harden Hugo builds and vendor Congo theme

.github/workflows/hugo.yml

@@ -1,5 +1,5 @@
-# Version-locked deployment workflow for Hugo site with Congo theme
-# Hugo 0.149.0 + Congo v2.12.2 + Go 1.25.0 for reproducible builds
+# Version-locked deployment workflow for Hugo site with vendored Congo theme
+# Hugo 0.160.1 + Congo v2.12.2 for reproducible builds
 name: Deploy Hugo site
 
 on:
@@ -12,65 +12,32 @@ jobs:
     runs-on: ubuntu-latest
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}
+    env:
+      HUGO_CACHEDIR: ${{ github.workspace }}/.hugo_cache
     steps:
       - uses: actions/checkout@v6.0.2
         with:
           fetch-depth: 0    # Fetch all history for .GitInfo and .Lastmod
 
-      - name: Extract versions from go.mod
+      - name: Read pinned Hugo version
         id: versions
         run: |
-          GO_VERSION=$(grep "^go " go.mod | awk '{print $2}')
-          HUGO_VERSION=$(grep "github.com/gohugoio/hugo v" go.mod | awk '{print $2}' | sed 's/v//')
-          echo "go_version=${GO_VERSION}.0" >> $GITHUB_OUTPUT
+          HUGO_VERSION=$(cat .hugo-version)
           echo "hugo_version=${HUGO_VERSION}" >> $GITHUB_OUTPUT
-          echo "Using Go version: ${GO_VERSION}.0"
           echo "Using Hugo version: ${HUGO_VERSION}"
-
-      - name: Setup Go
-        uses: actions/setup-go@v6.4.0
-        with:
-          go-version: ${{ steps.versions.outputs.go_version }}
 
       - name: Setup Hugo
         uses: peaceiris/actions-hugo@v3.0.0
         with:
           hugo-version: ${{ steps.versions.outputs.hugo_version }}
           extended: true
 
-      - name: Debug Environment
+      - name: Verify vendored theme
         run: |
-          echo "Current directory structure:"
-          ls -la
-          echo "Hugo configuration:"
-          cat config.yaml
-          echo "Hugo module configuration:"
-          hugo mod graph || echo "Hugo mod graph failed"
-          echo "Go mod configuration:"
-          cat go.mod || echo "No go.mod file found"
-
-      - name: Setup Hugo Modules
-        run: |
-          # Clean start - remove any existing module files that might be corrupted
-          rm -f go.sum
-
-          # Only initialize if go.mod doesn't exist
-          if [ ! -f go.mod ]; then
-            echo "Initializing Hugo modules..."
-            hugo mod init github.com/cloudartisan/cloudartisan.github.io
-          else
-            echo "go.mod already exists, using existing module configuration"
-          fi
-
-          # Ensure modules are up to date
-          hugo mod tidy
-
-          # Verify module setup
-          echo "Module status:"
-          hugo mod graph
+          test -f _vendor/modules.txt
 
       - name: Build
-        run: hugo --minify --buildFuture
+        run: ./scripts/hugo.sh --minify --buildFuture
 
       - name: Copy CNAME file
         run: |
@@ -87,4 +54,4 @@ jobs:
           publish_dir: ./public
           publish_branch: gh-pages  # deploying to gh-pages branch
           cname: cloudartisan.com   # Explicit CNAME setting for custom domain
-          force_orphan: true        # Force clean deployment
+          force_orphan: true        # Force clean deployment

.github/workflows/pr-validation.yml

@@ -9,64 +9,47 @@ on:
       - 'content/**'
       - 'config.yaml'
       - 'go.mod'
+      - 'go.sum'
+      - '.hugo-version'
       - 'layouts/**'
       - 'assets/**'
       - 'static/**'
+      - '_vendor/**'
+      - 'scripts/**'
+      - '.gitignore'
       - '.github/workflows/**'
 
 jobs:
   validate-build:
     runs-on: ubuntu-latest
+    env:
+      HUGO_CACHEDIR: ${{ github.workspace }}/.hugo_cache
     steps:
       - uses: actions/checkout@v6.0.2
         with:
           fetch-depth: 0
 
-      - name: Extract versions from go.mod
+      - name: Read pinned Hugo version
         id: versions
         run: |
-          GO_VERSION=$(grep "^go " go.mod | awk '{print $2}')
-          HUGO_VERSION=$(grep "github.com/gohugoio/hugo v" go.mod | awk '{print $2}' | sed 's/v//')
-          echo "go_version=${GO_VERSION}.0" >> $GITHUB_OUTPUT
+          HUGO_VERSION=$(cat .hugo-version)
           echo "hugo_version=${HUGO_VERSION}" >> $GITHUB_OUTPUT
-          echo "Using Go version: ${GO_VERSION}.0"
           echo "Using Hugo version: ${HUGO_VERSION}"
-
-      - name: Setup Go
-        uses: actions/setup-go@v6.4.0
-        with:
-          go-version: ${{ steps.versions.outputs.go_version }}
 
       - name: Setup Hugo
         uses: peaceiris/actions-hugo@v3.0.0
         with:
           hugo-version: ${{ steps.versions.outputs.hugo_version }}
           extended: true
 
-      - name: Setup Hugo Modules
+      - name: Verify vendored theme
         run: |
-          # Clean start - remove any existing module files that might be corrupted
-          rm -f go.sum
-
-          # Only initialize if go.mod doesn't exist
-          if [ ! -f go.mod ]; then
-            echo "Initializing Hugo modules..."
-            hugo mod init github.com/cloudartisan/cloudartisan.github.io
-          else
-            echo "go.mod already exists, using existing module configuration"
-          fi
-
-          # Ensure modules are up to date
-          hugo mod tidy
-
-          # Verify module setup
-          echo "Module status:"
-          hugo mod graph
+          test -f _vendor/modules.txt
 
       - name: Validate Hugo Configuration
         run: |
           echo "Validating Hugo configuration..."
-          hugo config
+          ./scripts/hugo.sh config
           echo "✅ Configuration is valid"
 
       - name: Check for Draft Posts
@@ -95,13 +78,13 @@ jobs:
       - name: Test Build (Development)
         run: |
           echo "Testing development build..."
-          hugo --buildDrafts --buildFuture
+          ./scripts/hugo.sh --buildDrafts --buildFuture
           echo "✅ Development build successful"
 
       - name: Test Build (Production)
         run: |
           echo "Testing production build..."
-          hugo --minify --buildFuture
+          ./scripts/hugo.sh --minify --buildFuture
           echo "✅ Production build successful"
 
       - name: Check Build Output
@@ -254,4 +237,4 @@ jobs:
           fi
 
           echo "" >> $GITHUB_STEP_SUMMARY
-          echo "Your PR is ready to merge! 🚀" >> $GITHUB_STEP_SUMMARY
+          echo "Your PR is ready to merge! 🚀" >> $GITHUB_STEP_SUMMARY

.gitignore

@@ -6,6 +6,7 @@ Gemfile.lock
 
 # Hugo
 .hugo_build.lock
+.hugo_cache/
 /public/
 /resources/
 /jsconfig.json

.hugo-version

@@ -0,0 +1 @@
+0.160.1

AI.md

@@ -17,10 +17,12 @@
 - Repository is cloudartisan.github.io
 
 ## Build Commands
-- Install Hugo: `go install -tags extended github.com/gohugoio/hugo@v0.149.0`
-- Update theme modules: `hugo mod get -u`
-- Local development: `hugo server -D` (includes draft content)
-- Production build: `hugo` (generates static site in /public)
+- Install the Hugo extended binary (`brew install hugo` on macOS, or use the official Linux package/binary)
+- The repo pins Hugo via `.hugo-version` (currently `0.160.1`)
+- Local development: `./scripts/hugo.sh server -D` (includes draft content)
+- Production build: `./scripts/hugo.sh --minify --buildFuture` (generates static site in `/public`)
+- Refresh vendored theme modules when needed: `./scripts/hugo.sh mod vendor`
+- Go is only required when changing Hugo module dependencies
 - Create new post: `hugo new content/posts/my-post-name.md`
 - Create new project: `hugo new content/projects/project-name.md`
 

README.md

@@ -10,6 +10,8 @@ This site is built with:
 - [Hugo](https://gohugo.io/) - A fast and modern static site generator
 - [Congo Theme](https://github.com/jpanther/congo) - A powerful, lightweight theme for Hugo
 
+The theme is vendored under `_vendor/`, so day-to-day builds do not need Go or a live module download.
+
 ## Local Development
 
 1. Clone this repository:
@@ -18,20 +20,45 @@ This site is built with:
    cd cloudartisan.github.io
    ```
 
-2. Install Hugo (specific version to ensure compatibility):
-   ```
-    go install -tags extended github.com/gohugoio/hugo@v0.149.0
-   ```
-
-   Ensure your Go bin directory (typically ~/go/bin) is in your PATH.
+2. Install the Hugo extended binary:
+   - macOS (Homebrew): `brew install hugo`
+   - Linux: download the extended release from [gohugo.io](https://gohugo.io/installation/) or install it via your preferred package manager
 
-3. Run the local development server:
+   The site is pinned to Hugo `0.160.1` via `.hugo-version`.
+
+3. Build or run the site through the wrapper script:
    ```
-   hugo server -D
+   ./scripts/hugo.sh server -D
    ```
 
+   The wrapper keeps Hugo's cache inside the repository (`.hugo_cache/`), which avoids permission and path quirks on both macOS and Linux.
+
 4. View the site at http://localhost:1313/
 
+## Production Build
+
+```
+./scripts/hugo.sh --minify --buildFuture
+```
+
+## Updating Theme Dependencies
+
+Normal builds do not require Go. You only need Go when you want to refresh vendored Hugo modules, for example when updating Congo.
+
+1. Install a recent Go toolchain.
+2. Refresh the module dependency:
+   ```
+   hugo mod get github.com/jpanther/congo/v2@v2.12.2
+   ```
+3. Re-vendor the module:
+   ```
+   ./scripts/hugo.sh mod vendor
+   ```
+4. Re-run the build:
+   ```
+   ./scripts/hugo.sh --minify --buildFuture
+   ```
+
 ## Creating Content
 
 ### New Posts
@@ -115,7 +142,7 @@ python3 scripts/script_name.py      # Run the script
 ## Building for Production
 
 ```
-hugo
+./scripts/hugo.sh --minify --buildFuture
 ```
 
 This will generate the static site in the `public` directory.