Adopt the Hub's Reusable deploy-site-task.yml Workflow

[ptr727]

Adopts the hub's reusable deploy-site-task.yml, the last item from tonight's fleet resync (same shape as #99's validate-task.yml adoption).

What changed

• .github/workflows/deploy-site.yml's deploy job now calls ptr727/ProjectTemplate/.github/workflows/deploy-site-task.yml@cd7bae9... # 2.0.448 instead of the local ./.github/workflows/deploy-site-task.yml, with an explicit secrets: map (secrets: inherit does not cross repositories).
• .github/workflows/deploy-site-task.yml (this repo's carried copy) is deleted.
• New .github/actions/deploy/action.yml: this repo's own deploy hook for the hub task's three modes (build, prune, verify). Prune is a deliberate no-op — OPERATIONS.md already documents that the host's blog-prune-releases.timer owns retention, not this repo's deploy key.
• The GitHub Environment variable HUGO_BASEURL is renamed to SITE_BASE_URL on both staging and production (done live, before this PR), matching the hub task's own generic, non-Hugo-specific interface. The hook bridges it back to HUGO_BASEURL for Hugo and this repo's own scripts, which keep reading that name exactly as OPERATIONS.md documents — no script changes needed.
• PANGOLIN_ACCESS_TOKEN_ID/PANGOLIN_ACCESS_TOKEN forward as the hub task's generic SITE_AUTH_TOKEN_ID/SITE_AUTH_TOKEN via the caller's explicit secrets: map. Production maps both to empty (neither secret is set there), which the hub task's own assert step treats as a public site with no auth gate, correctly.
• checks/check-env-docs.py gained a second, separately-commented allowlist (HUB_HOSTED_ENVIRONMENT_VALUES) for GitHub Environment values now read directly by the hub-hosted task rather than by a workflow file this repo's own scan can see (SITE_BASE_URL, DEPLOY_SSH_HOST, DEPLOY_SSH_USER, DEPLOY_SSH_KNOWN_HOSTS).
• ENVIRONMENT.md and TODO.md updated to reflect the SITE_BASE_URL rename where they described the GitHub Environment variable specifically; HUGO_BASEURL stays documented for the local secrets/<env>.env shape and Hugo's own native convention, unchanged.

Verified

scripts/docker_lint.py --linter actionlint --linter editorconfig-checker, scripts/prose_lint.py --diff origin/main, scripts/repo_gate.py --check sha-pin --exclude 'themes/*/**', checks/check-env-docs.py, and uvx ruff check all pass clean.

Not yet verified: an actual staging dispatch through this new path (planned as the next step once this merges, before ever touching production).

Summary by CodeRabbit

• New Features

  • Added a standardized deployment process for building sites and verifying live deployments.
  • Improved consistency when passing site authentication and environment configuration during deployment.

• Documentation

  • Renamed the site URL configuration setting to SITE_BASE_URL.
  • Updated deployment guidance and configuration references.

• Chores

  • Added validation for hub-hosted deployment environment values.
  • Simplified deployment workflow maintenance by using a shared deployment process.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2df7eda1-ce7f-4999-ba86-16eda83c38a2

📥 Commits

Reviewing files that changed from the base of the PR and between 49aa1ab and 9ea7f5e.

📒 Files selected for processing (1)

• AUDIT.md

Included review availability: Your plan provides up to 10 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The deployment logic moves into a composite action. The deployment job now calls a pinned cross-repository workflow with explicit secrets. Environment documentation and validation now use SITE_BASE_URL and recognize hub-hosted deployment values.

Changes

Deployment migration

Layer / File(s)	Summary
Composite deployment action .github/actions/deploy/action.yml	Adds build, mtime validation, release bundling, host-owned pruning, and authenticated live URL verification modes.
Reusable workflow integration .github/workflows/deploy-site.yml	Routes deployment through the pinned cross-repository workflow and passes SSH and authentication secrets explicitly. The local reusable workflow is removed.
Environment contract and validation ENVIRONMENT.md, TODO.md, checks/check-env-docs.py, AUDIT.md	Renames the documented variable to SITE_BASE_URL, preserves the build bridge to HUGO_BASEURL, registers hub-hosted environment values, and updates the documented fleet deviations.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk:⚪ Minimal · up to 9ea7f

The workflow adoption and related documentation changes are merge-ready after normal checks; no actionable merge-blocking risk remains.

Sequence Diagram(s)

sequenceDiagram
participant deploy_site as deploy-site.yml
participant deploy_task as cross-repository deploy-site-task.yml
participant deploy_action as deploy action
participant hugo as Hugo
deploy_site->>deploy_task: Pass environment and deployment secrets
deploy_task->>deploy_action: Invoke deployment mode
deploy_action->>hugo: Build with HUGO_BASEURL
deploy_action->>deploy_task: Return bundle or verification result

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the primary change: adopting the Hub's reusable deploy-site-task.yml workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch adopt-deploy-site-task

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Adopt hub reusable deploy-site-task workflow with repo-specific deploy hook

✨ Enhancement⚙️ Configuration changes📝 Documentation🕐 20-40 Minutes

AI Description

• Switch deploy workflow to call the hub-hosted reusable deploy-site-task.yml (SHA-pinned)
• Add a repo-local composite deploy hook to implement build/prune/verify for the hub task
• Rename GitHub Environment base URL variable to SITE_BASE_URL and update env-doc checks/docs

Diagram

graph TD
A[".github/workflows/deploy-site.yml"] --> B["Hub deploy-site-task.yml@2.0.448"] --> G["Remote host (SSH/rsync)"]
H[("GitHub Environments")] --> B --> C(".github/actions/deploy")
C --> D("deploy/make-release.sh") --> E["Release bundle"]
C --> F("checks/check-live-urls.sh") --> G

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Keep vendored local deploy-site-task.yml

• ➕ Fully self-contained; no cross-repo secrets mapping needed
• ➕ Local tooling (linters/scanners) can directly see workflow references
• ➖ Ongoing drift risk vs hub workflow; duplicated maintenance across repos
• ➖ Harder to enforce consistent security/pinning updates fleet-wide

2. Pin to a release tag instead of a commit SHA

• ➕ Easier to read/maintain; aligns with semantic versions
• ➕ Can allow controlled updates without changing the workflow file each bump
• ➖ Weaker supply-chain posture than SHA pinning (tag retargeting risk)
• ➖ May conflict with existing sha-pin repo policy/gates

3. Implement build/prune/verify directly in deploy-site.yml (no composite action)

• ➕ Single file to debug in this repo
• ➕ No need to reason about composite-action env passing quirks
• ➖ Breaks the hub task’s intended extension mechanism and reduces reuse
• ➖ More duplication across repos that adopt the hub workflow

Recommendation: Current approach (hub reusable workflow + SHA pin + repo-local composite deploy hook) is the best tradeoff for fleet consistency and security. The explicit cross-repo secrets mapping and the SITE_BASE_URL→HUGO_BASEURL bridge keep the hub interface generic without forcing repo-wide script changes, while still preserving the repo’s documented Hugo conventions.

Files changed (5) +130 / -10

Tests (1) +16 / -3

check-env-docs.pyTeach env-doc linter about environment values read by hub-hosted workflow+16/-3

Teach env-doc linter about environment values read by hub-hosted workflow

• Adds HUB_HOSTED_ENVIRONMENT_VALUES to account for GitHub Environment vars consumed by the external reusable workflow (and therefore not visible in this repo’s workflow scans). Also modernizes regex flags to re.MULTILINE for clarity/consistency.

checks/check-env-docs.py

Documentation (2) +5 / -5

ENVIRONMENT.mdDocument SITE_BASE_URL as the GitHub Environment base URL variable+2/-2

Document SITE_BASE_URL as the GitHub Environment base URL variable

• Updates the GitHub Environments section to rename HUGO_BASEURL to SITE_BASE_URL for the hosted workflow interface while explicitly documenting the one-place bridge back to HUGO_BASEURL for Hugo and repo scripts. Keeps the operational warning about the base URL being used for both build and verification.

ENVIRONMENT.md

TODO.mdUpdate production/staging notes to reference SITE_BASE_URL rename+3/-3

Update production/staging notes to reference SITE_BASE_URL rename

• Renames references to the GitHub Environment variable from HUGO_BASEURL to SITE_BASE_URL in the operational checklist text and the secrets/variables summary table, without changing the local file/env conventions for Hugo.

TODO.md

Other (2) +109 / -2

action.ymlAdd composite deploy hook for hub build/prune/verify modes+101/-0

Add composite deploy hook for hub build/prune/verify modes

• Introduces a composite action that implements the hub task’s three-mode contract. Build mode installs tooling, restores mtimes, installs Hugo, and runs make-release with SITE_BASE_URL bridged to HUGO_BASEURL. Prune mode is a deliberate no-op, and verify mode runs the live URL contract check with optional auth token forwarding.

.github/actions/deploy/action.yml

deploy-site.ymlSwitch deploy job to hub-hosted deploy-site-task and map secrets explicitly+8/-2

Switch deploy job to hub-hosted deploy-site-task and map secrets explicitly

• Replaces the local reusable workflow call with a SHA-pinned reference to ptr727/ProjectTemplate’s deploy-site-task.yml. Adds an explicit secrets map for cross-repo invocation, forwarding deploy SSH key and mapping PANGOLIN auth secrets onto the hub task’s generic SITE_AUTH_TOKEN_* names.

.github/workflows/deploy-site.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0)📘 Rule violations (1)📜 Skill insights (0)

1. Last word not title-cased 📘 Rule violation✧ Quality

Description

The PR title ends with deploy-site-task.yml, which starts with a lowercase letter; this violates
the title-case requirement that the last word start with an uppercase A–Z letter.

Code

.github/workflows/deploy-site.yml[60]

+ uses: ptr727/ProjectTemplate/.github/workflows/deploy-site-task.yml@cd7bae9ea830d2e42d1f7bb6e45b3e7f631c0668 # 2.0.448

Relevance

●●● Strong

Title-case compliance is a deterministic repository rule; the reported lowercase final word directly
violates it.

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

PR Compliance ID 2826395 requires the last word of the PR title to start with an uppercase A–Z
letter; the title ends with deploy-site-task.yml, which starts with d (lowercase).

Rule 2826395: Enforce title case in pull request titles with short bind words in lowercase

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
## Issue description
The PR title violates the title-case rule because the last word begins with a lowercase letter (`deploy-site-task.yml`).
## Issue Context
This is a PR-title formatting requirement; no code change is required.
## Fix Focus Areas
- .github/workflows/deploy-site.yml[60-60]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Stale audit documentation✗ Dismissed🐞 Bug⚙ Maintainability

Description

AUDIT.md and reports/Blog/audit.md still describe the old local deploy-site-task.yml path and
environment surface (HUGO_BASEURL, secrets: inherit), which is now incorrect after switching
deploy-site.yml to the hub workflow and deleting the local task file. This creates broken links and
misleading operational/audit guidance.

Code

.github/workflows/deploy-site.yml[R60-63]

+ uses: ptr727/ProjectTemplate/.github/workflows/deploy-site-task.yml@cd7bae9ea830d2e42d1f7bb6e45b3e7f631c0668 # 2.0.448
with:
environment: ${{ inputs.environment }}
permissions:

Relevance

●●● Strong

Recent accepted reviews consistently require documentation to match changed workflow behavior and
remove stale operational claims.

PR-#83
PR-#56
PR-#77

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The deploy workflow now calls the hub reusable workflow, but AUDIT.md and the blog audit report
still explicitly describe the old local deploy-site-task.yml and link to it. The blog audit report
also still lists HUGO_BASEURL as the environment variable and claims secrets: inherit is used, both
of which contradict the updated workflow.

.github/workflows/deploy-site.yml[57-71]
AUDIT.md[11-15]
reports/Blog/audit.md[64-72]
reports/Blog/audit.md[79-80]
reports/Blog/audit.md[118-123]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
### Issue description
This PR switches the deploy workflow to use the hub’s reusable `deploy-site-task.yml` and deletes the local `.github/workflows/deploy-site-task.yml`, but multiple audit/ops docs still:
- claim `deploy-site.yml` calls the local task,
- link to the deleted file,
- refer to `HUGO_BASEURL` as the GitHub Environment variable,
- claim `secrets: inherit` is used.
These statements are now incorrect and some links are broken, which can mislead future audits and operational debugging.
### Issue Context
The deploy workflow now uses the hub reusable workflow and the GitHub Environment variable was renamed to `SITE_BASE_URL`.
### Fix Focus Areas
- AUDIT.md[11-16]
- reports/Blog/audit.md[64-81]
- reports/Blog/audit.md[118-123]
- .github/workflows/deploy-site.yml[57-71]
### Suggested changes
- In `AUDIT.md`, update the bullet that currently says `deploy-site.yml` calls the local `deploy-site-task.yml` to reflect that it now calls the hub-hosted reusable workflow.
- In `reports/Blog/audit.md`:
- Update the environment values table row from `HUGO_BASEURL` to `SITE_BASE_URL` (and adjust any prose that depends on the old name).
- Remove/update the sentence claiming `secrets: inherit` in `deploy-site.yml`.
- Replace citations/links to the deleted `.github/workflows/deploy-site-task.yml` with either:
- links to the hub workflow (if appropriate for this repo’s documentation policy), or
- links to the new local hook action `.github/actions/deploy/action.yml` / `.github/workflows/deploy-site.yml` for the behavior that remains in-repo.
- Ensure the updated docs match the new cross-repo interface names (e.g., `SITE_BASE_URL`, `SITE_AUTH_TOKEN_ID/SITE_AUTH_TOKEN` mapping) without re-introducing references to deleted paths.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 13 rules

✅ Web pages:

🌐 Actions workflow syntax: `if` without expression syntax `${{ }}` can result in YAML syntax error

🌐 Be more precise when expression syntax ${{ }} can be omitted in if statement · Pull Request #27497 · github/docs

🌐 ${{ / }} wrappings around Job status check functions could be omitted · Issue #7601 · github/docs

+12 more

Review mode: ⚖️ Balanced: Downgraded extended -> standard: change is below the extended eligibility bar (hunks 8/18, lines 331/200; both must reach the floor). Router rationale: This cross-repository deployment workflow changes multiple independent build, prune, verify, environment, and secret-mapping paths, creating a dense set of easy-to-miss integration and security defects.

Tip of the day

💡 Did you know, you can switch off images and animations for a plain-text comment

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[ptr727]

Answering "Stale audit documentation" (qodo-code-review, Code Review comment, finding 2):

AUDIT.md — Fixed in 9ea7f5e: retired the resolved 'deploy-site-task.yml still calls this repo's own local copy' scope item, since this same PR is that adoption.

reports/Blog/audit.md — Not touched, and won't be. It's a dated point-in-time snapshot, not a living doc: its own header states the discipline directly, "a run records what it observed, and a later run supersedes the whole file." It already predates several other now-superseded facts beyond the ones cited here (declared as of hub ref 3b802b9, 2026-08-05). The next audit run supersedes it wholesale, per the same disposition already applied to an identical finding on #100.