Use Hugo USWDS theme as a Hugo module

.env

@@ -0,0 +1 @@
+HUGO_VERSION=0.118.2

.github/dependabot.yml

@@ -1,17 +1,12 @@
 version: 2
 updates:
-  - package-ecosystem: "gitsubmodule"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    target-branch: "develop"
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "daily"
     target-branch: "develop"
   - package-ecosystem: "gomod"
-    directory: "/build"
+    directory: "/website"
     schedule:
       interval: "daily"
     target-branch: "develop"

.github/workflows/config/.env

@@ -0,0 +1 @@
+HUGO_VERSION=0.118.2

.github/workflows/config/.lycheeignore

@@ -0,0 +1,4 @@
+https://search.usa.gov/search
+https://github.com/usnistgov/metaschema/tree/master/website/content/*
+https://csrc.nist.gov/*
+https://nvd.nist.gov/*

.github/workflows/config/.markdown-link-check/config.json

@@ -0,0 +1,34 @@
+{
+  "ignorePatterns": [
+        {
+            "pattern": "https://docs.github.com"
+        },
+        {
+            "pattern": "https://guides.github.com"
+        },
+        {
+            "pattern": "https://help.github.com"
+        },
+        {
+            "pattern": "https://www.bottlecaps.de/rex/"
+        }
+  ],
+  "replacementPatterns": [
+        {
+            "pattern": "^../../issues",
+            "replacement": "https://github.com/usnistgov/metaschema/issues"
+        },
+        {
+            "pattern": "^../../projects",
+            "replacement": "https://github.com/usnistgov/metaschema/projects"
+        },
+        {
+            "pattern": "^../../releases",
+            "replacement": "https://github.com/usnistgov/metaschema/releases"
+        },
+        {
+            "pattern": "^../../tree",
+            "replacement": "https://github.com/usnistgov/metaschema/tree"
+        }
+    ]
+}

.github/workflows/config/.nvmrc

@@ -0,0 +1 @@
+v16

.github/workflows/link-check.yml

@@ -26,7 +26,7 @@ on:
         required: true
         default: 'published'
         type: string
-      create_issue:
+      linkcheck_create_issue:
         description: 'create new GitHub issue if broken links found'
         required: false
         default: true
@@ -38,25 +38,25 @@ jobs:
     with:
       ignorePattern: '^website/'
       markdownLinkCheckConfig: 'build/config/.markdown-link-check/config.json'
-      create_issue: true
+      linkcheck_create_issue: true
   schedule-validate-repo-markdown-links-debug:
     uses: ./.github/workflows/workflow-validate-repo-markdown.yml
     if: github.event_name == 'workflow_dispatch'
     with:
       ignorePattern: ${{ github.event.inputs.ignorePattern }}
       markdownLinkCheckConfig: ${{ github.event.inputs.markdownLinkCheckConfig }}
-      create_issue: ${{ contains('true', github.event.inputs.create_issue) }}
+      linkcheck_create_issue: ${{ contains('true', github.event.inputs.linkcheck_create_issue) }}
   schedule-validate-website-links:
     uses: ./.github/workflows/workflow-validate-website-content.yml
     if: github.event_name != 'workflow_dispatch'
     with:
       site_git_ref: 'nist-pages'
       site_git_ref_path: 'published'
-      create_issue: true
+      linkcheck_create_issue: true
   schedule-validate-website-links-debug:
     uses: ./.github/workflows/workflow-validate-website-content.yml
     if: github.event_name == 'workflow_dispatch'
     with:
       site_git_ref: ${{ github.event.inputs.site_git_ref }}
       site_git_ref_path: ${{ github.event.inputs.site_git_ref_path }}
-      create_issue: ${{ contains('true', github.event.inputs.create_issue) }}
+      linkcheck_create_issue: ${{ contains('true', github.event.inputs.linkcheck_create_issue) }}

.github/workflows/status-ci-cd.yml

@@ -1,4 +1,4 @@
-name: Metaschema CI/CD
+name: CI/CD
 on:
   push:
     branches:
@@ -26,5 +26,3 @@ jobs:
     uses: ./.github/workflows/workflow-generate-website.yml
     with:
       commit_resources: true
-    secrets:
-      access_token: ${{ secrets.COMMIT_TOKEN }}

.github/workflows/workflow-generate-website.yml

@@ -7,15 +7,11 @@ on:
         required: false
         default: false
         type: boolean
-      bad_links_fail_build:
+      linkcheck_fail_on_error:
         description: 'a boolean flag that determines if bad links found by the link checker fail fast and stop a complete build'
         required: false
         default: true
         type: boolean
-    secrets:
-      access_token:
-        description: 'the access token to use for commits'
-        required: false
   workflow_dispatch:
     branches:
     - main
@@ -27,12 +23,12 @@ on:
         required: true
         default: false
         type: boolean
-      bad_links_fail_build:
+      linkcheck_fail_on_error:
         description: 'a boolean flag that determines if bad links found by the link checker fail fast and stop a complete build'
         required: false
         default: true
         type: boolean
-      create_issue:
+      linkcheck_create_issue:
         description: 'create new GitHub issue if broken links found'
         required: false
         default: false
@@ -42,29 +38,21 @@ jobs:
     name: Build and Push Website
     runs-on: ubuntu-20.04
     env:
-      JAVA_CLASSPATH: ${{ github.workspace}}/lib
       BUILD_PATH: ./build
-      CICD_PATH: ./build/ci-cd
+    permissions:
+      contents: write
     steps:
-    # use this for builds triggered from the UI on protected branches
-    - name: Checkout Latest (using COMMIT_TOKEN)
-      if: github.event_name == 'workflow_dispatch' && github.event.inputs.commit_resources == 'true'
-      uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
-      with:
-        token: ${{ secrets.COMMIT_TOKEN }}
-        submodules: recursive
-      id: checkout_latest_workflow
-    # use this for builds triggered from other workflows on protected branches
-    - name: Checkout Latest (using access_token)
-      if: github.event_name == 'push' && inputs.commit_resources == true
+    # use this for builds triggered from the UI and from workflows on protected branches
+    - id: checkout_latest_workflow
+      name: Checkout Latest
+      if: (github.event_name == 'workflow_dispatch' && github.event.inputs.commit_resources == 'true') || (github.event_name == 'push' && inputs.commit_resources == true)
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
       with:
-        token: ${{ secrets.access_token }}
+        token: ${{ secrets.GITHUB_TOKEN  }}
         submodules: recursive
-      id: checkout_latest_push
     # use this for overything else (i.e., pull requests) where publication is not needed
     - name: Checkout Latest
-      if: steps.checkout_latest_workflow.conclusion == 'skipped' && steps.checkout_latest_push.conclusion == 'skipped'
+      if: steps.checkout_latest_workflow.conclusion == 'skipped'
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
       with:
         submodules: recursive
@@ -74,29 +62,22 @@ jobs:
       with:
         swap-size-gb: 10
     # Install Hugo
-    - name: Store Hugo Executable in Cache
-      uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84
-      with:
-        path: /home/runner/go/bin/hugo
-        key: ${{ runner.os }}-hugo-${{ hashFiles(format('{0}/go.sum', env.BUILD_PATH)) }}
-      id: cache-hugo
-    - name: Add Cached Hugo Executable to PATH
-      if: steps.cache-hugo.outputs.cache-hit == 'true'
+    - name: Read .env
+      id: hugo-version
       run: |
-        echo "/home/runner/go/bin" >> $GITHUB_PATH
-    - name: Setup Golang
-      if: steps.cache-hugo.outputs.cache-hit != 'true'
-      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe
+        . .github/workflows/config/.env
+        echo "HUGO_VERSION=${HUGO_VERSION}" >> "${GITHUB_OUTPUT}"
+    - name: Setup Hugo
+      uses: peaceiris/actions-hugo@v2
       with:
-        go-version-file: '${{ env.BUILD_PATH }}/go.mod'
-        cache: true
-        cache-dependency-path: '${{ env.BUILD_PATH }}/go.sum'
+        hugo-version: '${{ steps.hugo-version.outputs.HUGO_VERSION }}'
+        extended: true
     - name: Set up NodeJS
       uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d
       with:
-        node-version-file: 'build/.nvmrc'
+        node-version-file: '.github/workflows/config/.nvmrc'
         cache: 'npm'
-        cache-dependency-path: 'package-lock.json'
+        cache-dependency-path: package-lock.json
     - name: Setup Dependencies
       run: |
         # NodeJS
@@ -111,65 +92,67 @@ jobs:
         echo "$PWD/node_modules/.bin/" >> $GITHUB_PATH
         # Dart-Sass
         sudo snap install dart-sass
-    - name: Install Hugo
-      if: steps.cache-hugo.outputs.cache-hit != 'true'
-      run: |
-        cd "${{ env.BUILD_PATH }}"
-        go install -tags "extended" github.com/gohugoio/hugo
-    - name: Install Dart Sass Embedded
-      run: sudo snap install dart-sass-embedded
+    # cache hugo modules
+    - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84
+      with:
+        path: /tmp/hugo_cache
+        key: ${{ runner.os }}-hugomod-${{ hashFiles('**/go.sum') }}
+        restore-keys: |
+          ${{ runner.os }}-hugomod-        
     - name: Run Hugo
       run: |
-        hugo --config "config.yaml,development-config.yaml" -v --debug --minify
+        hugo mod vendor
+        hugo -e production --logLevel debug --minify
       working-directory: ${{ github.workspace }}/website
     - name: Zip Artifacts for Upload
       run: |
         zip ${{ runner.temp }}/metaschema-website.zip -r public/
       working-directory: ${{ github.workspace }}/website
-    - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32
+    - name: Upload generated site
+      uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32
       with:
         name: website
         path: |
           ${{ runner.temp }}/metaschema-website.zip
         retention-days: 5
-    - name: Link Checker
-      id: linkchecker
+    - id: linkchecker
+      name: Link Checker
       uses: lycheeverse/lychee-action@ec3ed119d4f44ad2673a7232460dc7dff59d2421
       with:
-        args: --exclude-file ./build/config/.lycheeignore --verbose --no-progress --accept 200,206,429 './website/public/**/*.html' --remap "https://pages.nist.gov/metaschema/ file://${GITHUB_WORKSPACE}/website/public/" --exclude-mail
+        args: --exclude-file .github/workflows/config/.lycheeignore --verbose --no-progress --accept 200,206,429 './website/public/**/*.html' --remap "https://pages.nist.gov/metaschema/ file://${GITHUB_WORKSPACE}/website/public/" --exclude-mail
         format: markdown
         output: html-link-report.md
+        debug: true
+        fail: true
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32
+      continue-on-error: true
+    - name: Upload link check report
+      uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32
       with:
         name: html-link-report
         path: html-link-report.md
         retention-days: 5
-    - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410
-      if: steps.linkchecker.outputs.exit_code != 0
+    - name: Create issue if bad links detected
+      if: ${{ !cancelled() && env.lychee_exit_code != 0 && inputs.linkcheck_create_issue }}
+      uses: peter-evans/create-issue-from-file@433e51abf769039ee20ba1293a088ca19d573b7f
       with:
-        script: |
-          core.setFailed('Link checker detected broken or invalid links, read attached report.')
-    - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410
-      if: steps.linkchecker.outputs.exit_code != 0 && (github.event.inputs.bad_links_fail_build == 'true' || inputs.bad_links_fail_build == true)
+        title: Scheduled Check of Website Content Found Bad Hyperlinks
+        content-filepath: ./lychee/out.md
+        labels: |
+          bug
+          documentation
+    - name: Fail on link check error
+      if: ${{ !cancelled() && env.lychee_exit_code != 0 && (github.event.inputs.linkcheck_fail_on_error == 'true' || inputs.linkcheck_fail_on_error == true) }}
+      uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410
       with:
         script: |
           core.setFailed('Link checker detected broken or invalid links, read attached report.')
-    - name: Deploy Website (using access_token)
-      uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847
-      if: github.event_name == 'push' && inputs.commit_resources == true && github.ref_name == 'main'
-      with:
-        github_token: ${{ secrets.access_token }}
-        enable_jekyll: false
-        publish_dir: ./website/public
-        publish_branch: nist-pages
-        commit_message: Deploying website [ci deploy skip]
-    - name: Deploy Website (using COMMIT_TOKEN)
+    - name: Deploy Website
       uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847
-      if: github.event_name == 'workflow_dispatch' && github.event.inputs.commit_resources == 'true' && github.ref_name == 'main'
+      if: github.ref_name == 'main' && ((github.event_name == 'push' && inputs.commit_resources == true) || (github.event_name == 'workflow_dispatch' && github.event.inputs.commit_resources == 'true'))
       with:
-        github_token: ${{ secrets.COMMIT_TOKEN }}
+        github_token: ${{ secrets.GITHUB_TOKEN }}
         enable_jekyll: false
         publish_dir: ./website/public
         publish_branch: nist-pages

.github/workflows/workflow-validate-repo-markdown.yml

@@ -10,9 +10,9 @@ on:
       markdownLinkCheckConfig:
         description: 'the path to the markdown link check config file'
         required: false
-        default: 'build/config/.markdown-link-check/config.json'
+        default: '.github/workflows/config/.markdown-link-check/config.json'
         type: string
-      create_issue:
+      linkcheck_create_issue:
         description: 'create new GitHub issue if broken links found'
         required: false
         default: false
@@ -21,6 +21,9 @@ jobs:
   validate-repo-markdown:
     name: Validate Repo Markdown
     runs-on: ubuntu-20.04
+    permissions:
+      contents: read
+      issues: write
     steps:
     # use this for pulls where checkout is anonymous
     - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
@@ -31,7 +34,7 @@ jobs:
     - name: Set up NodeJS
       uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d
       with:
-        node-version-file: 'build/.nvmrc'
+        node-version-file: '.github/workflows/config/.nvmrc'
         cache: 'npm'
         cache-dependency-path: 'package-lock.json'
     - name: Setup Dependencies
@@ -59,11 +62,11 @@ jobs:
         exit ${PIPESTATUS[2]}
       id: linkchecker
     - name: Create issue if bad links detected in repo
-      if: failure() && inputs.create_issue == true
+      if: failure() && inputs.linkcheck_create_issue == true
       uses: peter-evans/create-issue-from-file@433e51abf769039ee20ba1293a088ca19d573b7f # v3.0.0
       with:
         title: Scheduled Check of Markdown Documents Found Bad Hyperlinks
         content-filepath: mlc_report.log
         labels: |
           bug
-          Scope: Documentation
+          documentation