tpl(ci): modernize CI/CD workflows

- Refactor build into reusable workflow (DRY)
- Add deploy.host config to control deployment target
- Upgrade to latest action versions (Node 22, Go 1.23, Python 3.13)
- Add timeout-minutes and concurrency groups for safety
- Use github.run_id for unique PR branch names
- Fix package_json_path for standalone repo compatibility
- Scope GITHUB_TOKEN to specific steps for security

templates/documentation/.github/workflows/upgrade.yml

@@ -19,13 +19,17 @@ permissions:
   contents: write
   pull-requests: write
 
+# Prevent duplicate upgrade runs
+concurrency:
+  group: upgrade-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   upgrade:
     name: Upgrade
     if: github.repository_owner != 'HugoBlox'
     runs-on: ubuntu-latest
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -33,20 +37,20 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: '22'
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          package_json_path: templates/documentation/package.json
+          package_json_path: ./package.json
           run_install: false
 
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.23'
 
       - name: Setup Hugo
         uses: peaceiris/actions-hugo@v3
@@ -56,6 +60,7 @@ jobs:
 
       - name: Run Upgrade CLI
         env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # Use manual input or default to stable for scheduled runs
           VERSION_TYPE: ${{ inputs.version_type || 'Stable' }}
         run: |
@@ -68,6 +73,7 @@ jobs:
           echo "Running upgrade with flags: $FLAGS"
           pnpm dlx hugoblox@latest upgrade $FLAGS
 
+
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@v6
         with:
@@ -84,7 +90,7 @@ jobs:
             **Verification:**
             - [ ] Check the Deploy Preview to ensure everything looks correct.
             - [ ] Merge this PR to apply the updates.
-          branch: "chore/upgrade-hugoblox"
+          branch: "chore/upgrade-hugoblox-${{ github.run_id }}"
           delete-branch: true
           base: main
           labels: |