Merge pull request #36 from shiftleftcyber/update-workflows #49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Workflow referenced from: https://gohugo.io/host-and-deploy/host-on-github-pages/ | |
| name: Deploy Hugo site to Pages | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| permissions: | |
| contents: read | |
| pages: write | |
| id-token: write | |
| concurrency: | |
| group: pages | |
| cancel-in-progress: false | |
| defaults: | |
| run: | |
| shell: bash | |
| working-directory: ./marketing | |
| jobs: | |
| # -------------------------------------------------- | |
| # 1️⃣ Build | |
| # -------------------------------------------------- | |
| build: | |
| runs-on: ubuntu-latest | |
| env: | |
| DART_SASS_VERSION: 1.93.2 | |
| GO_VERSION: 1.25.3 | |
| HUGO_VERSION: 0.152.2 | |
| NODE_VERSION: 22.20.0 | |
| TZ: America/Toronto | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| submodules: recursive | |
| fetch-depth: 0 | |
| - name: Setup Go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| cache: false | |
| - name: Setup Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - name: Setup Pages | |
| id: pages | |
| uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 | |
| - name: Create directory for user-specific executable files | |
| run: | | |
| mkdir -p "${HOME}/.local" | |
| - name: Install Dart Sass | |
| run: | | |
| curl -sLJO "https://github.com/sass/dart-sass/releases/download/${DART_SASS_VERSION}/dart-sass-${DART_SASS_VERSION}-linux-x64.tar.gz" | |
| tar -C "${HOME}/.local" -xf "dart-sass-${DART_SASS_VERSION}-linux-x64.tar.gz" | |
| rm "dart-sass-${DART_SASS_VERSION}-linux-x64.tar.gz" | |
| echo "${HOME}/.local/dart-sass" >> "${GITHUB_PATH}" | |
| - name: Install Hugo | |
| run: | | |
| curl -sLJO "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-amd64.tar.gz" | |
| mkdir "${HOME}/.local/hugo" | |
| tar -C "${HOME}/.local/hugo" -xf "hugo_extended_${HUGO_VERSION}_linux-amd64.tar.gz" | |
| rm "hugo_extended_${HUGO_VERSION}_linux-amd64.tar.gz" | |
| echo "${HOME}/.local/hugo" >> "${GITHUB_PATH}" | |
| - name: Verify installations | |
| run: | | |
| echo "Dart Sass: $(sass --version)" | |
| echo "Go: $(go version)" | |
| echo "Hugo: $(hugo version)" | |
| echo "Node.js: $(node --version)" | |
| - name: Install Node.js dependencies | |
| run: | | |
| [[ -f package-lock.json || -f npm-shrinkwrap.json ]] && npm ci || true | |
| - name: Configure Git | |
| run: | | |
| git config core.quotepath false | |
| - name: Cache restore | |
| id: cache-restore | |
| uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| with: | |
| path: ${{ runner.temp }}/hugo_cache | |
| key: hugo-${{ github.run_id }} | |
| restore-keys: | |
| hugo- | |
| - name: Build the site | |
| run: | | |
| hugo \ | |
| --gc \ | |
| --minify \ | |
| --baseURL "${{ steps.pages.outputs.base_url }}/" \ | |
| --cacheDir "${{ runner.temp }}/hugo_cache" | |
| - name: Cache save | |
| id: cache-save | |
| uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| with: | |
| path: ${{ runner.temp }}/hugo_cache | |
| key: ${{ steps.cache-restore.outputs.cache-primary-key }} | |
| - name: Upload artifact | |
| uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 | |
| with: | |
| path: ./marketing/public | |
| - name: Generate CycloneDX SBOM | |
| run: npx @cyclonedx/cyclonedx-npm --output-format JSON --output-file shiftleftcyber.github.io.cdx.json | |
| - name: Upload SBOM | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1 | |
| with: | |
| name: generated-sbom | |
| path: ./marketing/shiftleftcyber.github.io.cdx.json | |
| - name: Sign SBOM | |
| uses: shiftleftcyber/secure-sbom-action@542dffaadd81bc0614947d749720558a399e6454 # v2.4.0 | |
| with: | |
| sbom_file: marketing/shiftleftcyber.github.io.cdx.json | |
| secure_sbom_action: sign_sbom | |
| secure_sbom_api_key: ${{ secrets.SECURE_SBOM_API_KEY }} | |
| secure_sbom_signing_key_id: ${{ vars.SECURE_SBOM_SIGNING_KEY_ID }} | |
| - name: Upload Signed SBOM | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1 | |
| with: | |
| name: signed-sbom | |
| path: ./marketing/shiftleftcyber.github.io.cdx.signed.json | |
| # -------------------------------------------------- | |
| # 2️⃣ Deploy | |
| # -------------------------------------------------- | |
| deploy: | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| runs-on: ubuntu-latest | |
| needs: build | |
| steps: | |
| - name: Deploy to GitHub Pages | |
| id: deployment | |
| uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 |