Composite GitHub Actions for Hugo projects deploying to Azure
- generate-metadata
- build
- deploy
I am utilizing release-please-action
from Google to handle semantic versioning and cutting
releases via PRs in repos where these hugo/azure pipelines are used. It's also used within this repo hugo-azure-actions
to generate Releases that follow the traditional GitHub Actions semver format where you can specify
@major, @major.minor or @major.minor.patch when invoking each of them.
See available releases.
These Actions workflows and their CI/CD process are based on a simple GitHub PR-Ops flow:
- PR opened, or additional commits to an opened PR will build and deploy the Hugo site to dev.site-base-tld
- A Release-Please generated PR is opened that contains one or more Conventional Commits PRs (e.g.: feat, fix) will be built and deployed to stg.site-base-tld each time that release PR is opened or updated if more feature/fix PRs are merged into the branch it's monitoring.
- A Release-Please generated PR is merged into mainline, triggering a Release/tag event in GitHub, which will trigger a build/deploy to site-base-tld - typically, this would be your production environment.
The two central values to tweak here if you want to follow the above process are:
hugo-versionsite-base-tld
If you'd like to utilize these workflows similarly, I've included a sample cd.yml workflow below
to place within the GitHub repo hosting your Hugo site's code. This, in conjunction with a sample release-please.yml
workflow in that same Hugo code repo will provide the Release Please PR/semantic versioning automation if you use
Conventional Commits for PR titles.
# .github/workflows/cd.yml
name: cd
on:
pull_request:
types: [ synchronize, opened ]
release:
types:
- released
defaults:
run:
shell: bash
concurrency: cd
jobs:
gen-metadata:
runs-on: ubuntu-latest
outputs:
build-id: ${{ steps.build-metadata.outputs.artifact-id }}
build-domain: ${{ steps.build-metadata.outputs.composite-domain }}
env-target: ${{ steps.build-metadata.outputs.env-target }}
hugo-version: ${{ steps.build-metadata.outputs.hugo-version }}
steps:
- name: generate build metadata
id: build-metadata
uses: kevholmes/hugo-azure-actions/.github/actions/generate-metadata@v1
with:
hugo-version: 0.118.2
site-base-tld: cloverstack.dev
build:
runs-on: ubuntu-latest
needs: gen-metadata
environment:
name: ${{ needs.gen-metadata.outputs.env-target }}
url: ${{ needs.gen-metadata.outputs.build-domain }}
steps:
- name: checkout source
uses: actions/checkout@v3
with:
fetch-depth: 0
- name: build hugo site
uses: kevholmes/hugo-azure-actions/.github/actions/build@v1
with:
build-id: ${{ needs.gen-metadata.outputs.build-id }}
build-domain: ${{ needs.gen-metadata.outputs.build-domain }}
hugo-version: ${{ needs.gen-metadata.outputs.hugo-version }}
deploy-azure:
runs-on: ubuntu-latest
needs: [gen-metadata, build]
environment:
name: ${{ needs.gen-metadata.outputs.env-target }}
url: ${{ needs.gen-metadata.outputs.build-domain }}
steps:
- name: deploy hugo site to azure
uses: kevholmes/hugo-azure-actions/.github/actions/deploy@v1
with:
build-id: ${{ needs.gen-metadata.outputs.build-id }}
az-client-id: ${{ vars.CLIENT_ID }}
az-client-secret: ${{ secrets.CLIENT_SECRET }}
az-subscription-id: ${{ vars.SUBSCRIPTION_ID }}
az-tenant-id: ${{ vars.TENANT_ID }}
az-storage-acct: ${{ vars.AZ_STORAGE_ACCT }}
az-cdn-profile-name: ${{ vars.AZ_CDN_PROFILE_NAME }}
az-cdn-endpoint: ${{ vars.AZ_CDN_ENDPOINT }}
az-resource-group: ${{ vars.AZ_RESOURCE_GROUP }}
In the Release Please workflow below, RELEASER_TOKEN is a privileged PAT associated with a user.
GitHub Actions now prevents the Actions bot user from triggering downstream workflows due to CVE concerns.
This would prevent the CD workflow above from executing in our scenario and building/deploying the staged release
generated by Release-Please.
# .github/workflows/release-please.yml
name: release-please
on:
push:
branches:
- main
permissions:
contents: write
pull-requests: write
jobs:
release-please:
runs-on: ubuntu-latest
steps:
- uses: google-github-actions/release-please-action@v3
with:
release-type: go
token: ${{ secrets.RELEASER_TOKEN }}This is leveraging Azure Storage's Static Web hosting feature. I also utilize HTTPS-only and the Classic Azure CDN with auto-TLS rotation for the development environments. Three environments (dev, stg, prod) in this setup cost me $2.40 to $5.00 (USD) a month, depending on CDN traffic load.
If you'd like to see how this Azure infrastructure is set up, the Pulumi code describing it all is located at kevholmes/elyclover.com-infra.