ci: address zizmor findings (#68) #74

	name: Deploy Hugo site to Pages

	on:
	push:
	branches: ["main"]
	workflow_dispatch:

	permissions: {}

	# Allow one concurrent deployment
	concurrency:
	group: "pages"
	cancel-in-progress: true

	defaults:
	run:
	shell: bash

	jobs:
	build:
	runs-on: ubuntu-latest
	env:
	HUGO_VERSION: 0.108.0
	permissions:
	contents: read

	steps:
	- name: Install Hugo CLI
	run: \|
	wget -O "${RUNNER_TEMP}/hugo.deb" https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-amd64.deb \
	&& sudo dpkg -i "${RUNNER_TEMP}/hugo.deb"

	- name: Install Dart Sass Embedded
	run: sudo snap install dart-sass-embedded

	- name: Checkout
	uses: actions/checkout@v4
	with:
	submodules: recursive
	persist-credentials: false

	- name: Setup Pages
	id: pages
	uses: actions/configure-pages@v5

	- name: Install Node.js dependencies
	run: "[[ -f package-lock.json \|\| -f npm-shrinkwrap.json ]] && npm ci \|\| true"

	- name: Build with Hugo
	env:
	# For maximum backward compatibility with Hugo modules
	HUGO_ENVIRONMENT: production
	HUGO_ENV: production
	BASE_URL: ${{ steps.pages.outputs.base_url }}
	run: \|
	hugo \
	--minify \
	--baseURL "${BASE_URL}/"

	- name: Upload artifact
	uses: actions/upload-pages-artifact@v3
	with:
	path: ./public

	# Deployment job
	deploy:
	environment:
	name: github-pages
	url: ${{ steps.deployment.outputs.page_url }}
	runs-on: ubuntu-latest
	needs: build
	permissions:
	pages: write
	id-token: write

	steps:
	- name: Deploy to GitHub Pages
	id: deployment
	uses: actions/deploy-pages@v4

Provide feedback