Harden Hugo install in CI workflows for transient release-download failures (#318)
* Initial plan * Harden Hugo download retries in CI workflows * Retry Hugo downloads and tighten checksum checks * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Juan Manuel Servera <8036360+jmservera@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Copilot committed
Jun 8, 2026 at 09:23 UTC
0d33116e2560abb2418db9324231a13e41ed1458
2 files changed
+31
-8
.github/workflows/crawl-and-publish.yml
+15
-4
@@ -1082,11 +1082,22 @@ jobs:
1082
- name: Install Hugo
1083
run: |
1084
set -euo pipefail
1085
+ RELEASE_URL="https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}"
1086
TARBALL="hugo_extended_${HUGO_VERSION}_linux-amd64.tar.gz"
1086
- curl -sLJO "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/${TARBALL}"
1087
- curl -sLJO "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_${HUGO_VERSION}_checksums.txt"
1088
- sha256sum --check "hugo_${HUGO_VERSION}_checksums.txt" --ignore-missing
1089
- rm "hugo_${HUGO_VERSION}_checksums.txt"
1087
+ CHECKSUM_FILE="hugo_${HUGO_VERSION}_checksums.txt"
1088
+ curl --fail --silent --show-error --location --retry 5 --retry-delay 2 --retry-all-errors \
1089
+ --output "${TARBALL}" "${RELEASE_URL}/${TARBALL}"
1090
+ curl --fail --silent --show-error --location --retry 5 --retry-delay 2 --retry-all-errors \
1091
+ --output "${CHECKSUM_FILE}" "${RELEASE_URL}/${CHECKSUM_FILE}"
1092
+ checksum_line="$(awk -v file="${TARBALL}" '$NF == file {print; found=1} END {if (!found) exit 1}' "${CHECKSUM_FILE}")" || {
1093
+ echo "Error: No checksum entry for ${TARBALL} found in ${CHECKSUM_FILE}" >&2
1094
+ exit 1
1095
+ }
1096
+ if ! printf '%s\n' "${checksum_line}" | sha256sum --check; then
1097
+ echo "Error: Checksum verification failed for ${TARBALL}" >&2
1098
+ exit 1
1099
+ fi
1100
+ rm "${CHECKSUM_FILE}"
1101
mkdir -p "${HOME}/.local/hugo"
1102
tar -C "${HOME}/.local/hugo" -xf "${TARBALL}"
1103
rm "${TARBALL}"
.github/workflows/deploy-site.yml
+16
-4
@@ -48,13 +48,25 @@ jobs:
48
49
- name: Install Hugo
50
run: |
51
+ set -euo pipefail
52
+ RELEASE_URL="https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}"
53
TARBALL="hugo_extended_${HUGO_VERSION}_linux-amd64.tar.gz"
52
- curl -sLJO "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/${TARBALL}"
54
+ CHECKSUM_FILE="hugo_${HUGO_VERSION}_checksums.txt"
55
+ curl --fail --silent --show-error --location --retry 5 --retry-delay 2 --retry-all-errors \
56
+ --output "${TARBALL}" "${RELEASE_URL}/${TARBALL}"
57
58
# Download and verify checksums
55
- curl -sLJO "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_${HUGO_VERSION}_checksums.txt"
56
- sha256sum --check hugo_${HUGO_VERSION}_checksums.txt --ignore-missing || exit 1
57
- rm "hugo_${HUGO_VERSION}_checksums.txt"
59
+ curl --fail --silent --show-error --location --retry 5 --retry-delay 2 --retry-all-errors \
60
+ --output "${CHECKSUM_FILE}" "${RELEASE_URL}/${CHECKSUM_FILE}"
61
+ checksum_line="$(awk -v file="${TARBALL}" '$NF == file {print; found=1} END {if (!found) exit 1}' "${CHECKSUM_FILE}")" || {
62
+ echo "Error: No checksum entry for ${TARBALL} found in ${CHECKSUM_FILE}" >&2
63
+ exit 1
64
+ }
65
+ if ! printf '%s\n' "${checksum_line}" | sha256sum --check; then
66
+ echo "Error: Checksum verification failed for ${TARBALL}" >&2
67
+ exit 1
68
+ fi
69
+ rm "${CHECKSUM_FILE}"
70
71
mkdir -p "${HOME}/.local/hugo"
72
tar -C "${HOME}/.local/hugo" -xf "${TARBALL}"