tpl(ci): modernize CI/CD workflows

- Refactor build into reusable workflow (DRY)
- Add deploy.host config to control deployment target
- Upgrade to latest action versions (Node 22, Go 1.23, Python 3.13)
- Add timeout-minutes and concurrency groups for safety
- Use github.run_id for unique PR branch names
- Fix package_json_path for standalone repo compatibility
- Scope GITHUB_TOKEN to specific steps for security

templates/documentation/.github/workflows/build.yml

@@ -0,0 +1,111 @@
+name: Build
+
+env:
+  NODE_VERSION: '20'
+
+on:
+  # Standalone trigger for PR validation
+  pull_request:
+    branches: ['main']
+  # Reusable workflow trigger - called by deploy.yml
+  workflow_call:
+    outputs:
+      artifact-id:
+        description: 'The ID of the uploaded artifact'
+        value: ${{ jobs.build.outputs.artifact-id }}
+  # Allow manual trigger for testing
+  workflow_dispatch:
+
+# Read-only permissions for security
+permissions:
+  contents: read
+
+# Prevent duplicate builds for the same PR
+concurrency:
+  group: build-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    if: github.repository_owner != 'HugoBlox'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    outputs:
+      artifact-id: ${{ steps.upload.outputs.artifact-id }}
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        # Fetch history for Hugo's .GitInfo and .Lastmod
+        fetch-depth: 0
+
+    - name: Setup Node.js
+      uses: actions/setup-node@v6
+      with:
+        node-version: ${{ env.NODE_VERSION }}
+
+    - name: Setup pnpm
+      if: hashFiles('package.json') != ''
+      uses: pnpm/action-setup@v4
+
+    - name: Get Hugo Version
+      id: hugo-version
+      run: |
+        VERSION=$(grep "hugo_version" hugoblox.yaml | awk '{print $2}' | tr -d "'\""")
+        echo "HUGO_VERSION=$VERSION" >> $GITHUB_ENV
+
+    - name: Install dependencies
+      run: |
+        # Install Tailwind CLI if package.json exists
+        if [ -f "package.json" ]; then
+          echo "Installing Tailwind dependencies..."
+          pnpm install --no-frozen-lockfile || npm install
+        fi
+
+    - name: Setup Hugo
+      uses: peaceiris/actions-hugo@v3
+      with:
+        hugo-version: ${{ env.HUGO_VERSION }}
+        extended: true
+
+    # Cache dependencies (Go modules, node_modules) - stable, rarely changes
+    - uses: actions/cache@v4
+      with:
+        path: |
+          /tmp/hugo_cache_runner/
+          node_modules/
+          modules/*/node_modules/
+        key: ${{ runner.os }}-hugo-deps-${{ hashFiles('**/go.mod', '**/package-lock.json',
+          '**/pnpm-lock.yaml') }}
+        restore-keys: |
+          ${{ runner.os }}-hugo-deps-
+
+    # Cache Hugo resources (processed images, CSS) - invalidates only when assets/config change
+    - uses: actions/cache@v4
+      with:
+        path: resources/
+        key: ${{ runner.os }}-hugo-resources-${{ hashFiles('assets/**/*', 'config/**/*',
+          'hugo.yaml', 'package.json') }}
+        restore-keys: |
+          ${{ runner.os }}-hugo-resources-
+
+    - name: Build with Hugo
+      env:
+        HUGO_ENVIRONMENT: production
+        HUGO_BLOX_LICENSE: ${{ secrets.HUGO_BLOX_LICENSE }}
+      run: |
+        echo "Hugo Cache Dir: $(hugo config | grep cachedir)"
+        hugo --minify
+
+    - name: Generate Pagefind search index (if applicable)
+      run: |
+        # Check if site uses Pagefind search
+        if [ -f "package.json" ] && grep -q "pagefind" package.json; then
+          pnpm run pagefind || npx pagefind --site "public"
+        fi
+
+    - name: Upload artifact
+      id: upload
+      uses: actions/upload-pages-artifact@v4
+      with:
+        path: ./public