Fix Deploy Hugo site workflow — replace nonexistent actions/setup-hugo (#30)

* Scribe: Archive Phase 1 completion—decisions, logs, notifications, phase transition - Merged 4 inbox decisions into decisions.md (decisions archive, Copilot reviews, crawler hardening, Hugo/data validation) - Created per-agent Phase 1 logs: leela, bender, fry, amy, ralph, stdlib-crawler - Wrote Phase 1 completion summary: all 7 issues closed, PRs #25-#26 merged - Distributed Phase 1→Phase 2 transition notifications to all agents - Updated now.md: Phase 1 complete, Phase 2 (Automation) starting - Removed 2 inbox files (merged to decisions.md) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: Scribe checkpoint — Phase 1 decision archive, agent history updates - Archive 3 decisions from Bender (#8, #6) and Fry (#7) into decisions.md - Update Bender history: PR #27 (Issue #8) review complete, 7 findings addressed - Update Farnsworth history: PR #28 (Issue #9) review complete, 4 findings addressed - Orchestration logs created (non-committed: runtime state) - Session log created (non-committed: runtime state) - Both PRs ready for merge; Phase 2 unblocked for Amy (Generator) and Fry (Validator) Decisions archived: 1. Crawler Cache & Artifact Handoff (Bender #8) 2. Crawler Hardening (Bender #6) 3. Dry-Run Validation Findings (Fry #7) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: Leela review — PR #27 and #28 blocking findings Leela identified critical issues preventing merge: PR #27 (Bender #8 - crawl workflow): - Cache restore path mismatch: artifact restored to repo root (.) - Script reads cache from data/cache/, so warm-cache handoff broken - Requires path fix or artifact re-extraction PR #28 (Farnsworth #9 - analysis spec): - Heading name mismatch: spec requires '## Trending This Week' - Sample artifact uses '## Trending This Week (Stars Gained)' - Example does not satisfy its own contract Action: Return PRs to authors for fixes before merge approval Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Session checkpoint: Phase 0-1 complete (9 issues), workflow patterns established - Closed issues #1-#9 (37.5% of roadmap) - Merged PRs: #25 (dry run), #26 (crawler hardening), #27 (Actions), #28 (spec) - Established branch→PR→review→merge workflow with Copilot review gates - Implemented GraphQL pattern for review thread resolution - Ratified MCP architecture for crawler extensibility - 15 issues remaining in Phase 2-4 backlog - All agents aligned on workflow and checkpoints Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix Hugo deploy workflow setup Replace the nonexistent actions/setup-hugo step with an official Hugo release download for the pinned extended v0.161.1 build used by PaperMod.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add SHA-256 checksum verification for Hugo download Verify the downloaded Hugo tarball against the official checksums published with each release. This prevents tampering and ensures the integrity of the downloaded binary. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Juan Manuel Servera committed May 18, 2026 at 13:13 UTC 77505172e88087d0384427bc0310b0ac7a6ce92e
1 file changed +16 -5
.github/workflows/deploy-site.yml
+16 -5
@@ -30,11 +30,22 @@ jobs:
30 - name: Configure GitHub Pages
31 uses: actions/configure-pages@v5
32
33 - - name: Set up Hugo
34 - uses: actions/setup-hugo@v3
35 - with:
36 - hugo-version: ${{ env.HUGO_VERSION }}
37 - extended: true
33 + - name: Install Hugo
34 + run: |
35 + TARBALL="hugo_extended_${HUGO_VERSION}_linux-amd64.tar.gz"
36 + curl -sLJO "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/${TARBALL}"
37 +
38 + # Download and verify checksums
39 + curl -sLJO "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_${HUGO_VERSION}_checksums.txt"
40 + sha256sum --check hugo_${HUGO_VERSION}_checksums.txt --ignore-missing || exit 1
41 + rm "hugo_${HUGO_VERSION}_checksums.txt"
42 +
43 + mkdir -p "${HOME}/.local/hugo"
44 + tar -C "${HOME}/.local/hugo" -xf "${TARBALL}"
45 + rm "${TARBALL}"
46 + echo "${HOME}/.local/hugo" >> "${GITHUB_PATH}"
47 + export PATH="${HOME}/.local/hugo:${PATH}"
48 + hugo version
49
50 - name: Build site
51 run: hugo --minify