From 44cedce4c8e64e2d750cb4c7fad12fa0447a6d7f Mon Sep 17 00:00:00 2001 From: Arthur van de Vondervoort Date: Sun, 8 Nov 2026 09:52:12 +0100 Subject: [PATCH] chore(ci): run hugo mod npm pack before building Hugo hashes the project package.json into packages/hugoautogen/hugo_packagemeta.json and warns when the stored checksum no longer matches. With --panicOnWarning that warning fails the build, so every Dependabot npm bump broke CI until someone committed a regenerated metadata file. Regenerating it on the runner removes that manual step while keeping --panicOnWarning for real warnings. The step runs before npm ci, so a genuine change to module dependencies still fails as a lock-file mismatch. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/build.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index c3ebcbe..cd8b0c1 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -59,6 +59,16 @@ jobs: key: hugo-${{ runner.os }}-${{ hashFiles('go.sum', 'package-lock.json') }} restore-keys: | hugo-${{ runner.os }}- + - name: Sync Hugo npm metadata + # Regenerates packages/hugoautogen/hugo_packagemeta.json on the runner. Hugo + # hashes package.json into that checksum, so any version bump (e.g. from + # Dependabot) would otherwise trip the "npm dependencies are out of sync" + # warning, which --panicOnWarning turns into a build failure. Runs before + # npm ci so a real change to module dependencies still fails loudly as a + # lock-file mismatch. + env: + HUGO_CACHEDIR: ${{ runner.temp }}/hugo_cache + run: hugo mod npm pack - name: Install Node.js dependencies run: "[[ -f package-lock.json || -f npm-shrinkwrap.json ]] && npm ci || true" - name: Build with Hugo