ci: harden GitHub Actions workflows

Pin workflow actions to commit SHAs, set explicit permissions and timeouts, update Ubuntu runners, and include the generated action bundle.

Co-Authored-By: Codex <noreply@openai.com>

.github/workflows/codeql-analysis.yml

@@ -6,19 +6,24 @@ on:
       - main
   pull_request:
 
+permissions:
+  security-events: write
+  contents: read
+
 jobs:
   CodeQL-Build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@1521896cd211af95be3f02edf6f436e10b819c27 # v3.35.4
         with:
           languages: javascript
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v2
+        uses: github/codeql-action/autobuild@1521896cd211af95be3f02edf6f436e10b819c27 # v3.35.4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@1521896cd211af95be3f02edf6f436e10b819c27 # v3.35.4

.github/workflows/dependency-review.yml

@@ -10,7 +10,8 @@ permissions:
 
 jobs:
   dependency-review:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/dependency-review-action@v3
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0

.github/workflows/dev-image.yml

@@ -21,11 +21,15 @@ on:
       - 'Dockerfile'
       - 'Makefile'
 
+permissions:
+  contents: read
+
 jobs:
   dev-image-test:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - run: make build
       - run: make cirun cmd="npm ci"
       # - run: make ciall

.github/workflows/label-commenter.yml

@@ -10,16 +10,21 @@ on:
   #     - labeled
   #     - unlabeled
 
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   comment:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: main
 
       - name: Label Commenter
-        uses: peaceiris/actions-label-commenter@v1.10.0
+        uses: peaceiris/actions-label-commenter@c74c602750041f04c2bb68d200fc2fdae169a044 # v1.10.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           # config_file: .github/label-commenter-config.yml

.github/workflows/purge-readme-image-cache.yml

@@ -4,13 +4,16 @@ on:
   schedule:
     - cron: '4 18 * * */7'
 
+permissions: {}
+
 jobs:
   purge:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
     steps:
-
-    - run: >
-        curl -sL https://github.com/${GITHUB_REPOSITORY} |
-        grep -oE '<img src="https?://camo.githubusercontent.com/[^"]+' |
-        sed -e 's/<img src="//' |
-        xargs -I % curl -sX PURGE %
+      - name: Purge README image cache
+        run: >
+          curl -sL "https://github.com/${GITHUB_REPOSITORY}" |
+          grep -oE '<img src="https?://camo.githubusercontent.com/[^"]+' |
+          sed -e 's/<img src="//' |
+          xargs -I % curl -sX PURGE %

.github/workflows/release.yml

@@ -5,21 +5,15 @@ on:
     tags:
       - 'v*.*.*'
 
+permissions:
+  contents: write
+
 jobs:
   release:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-
-      - name: Dump GitHub context
-        env:
-          GITHUB_CONTEXT: ${{ toJson(github) }}
-        run: echo "${GITHUB_CONTEXT}"
-
-      - name: Install github/hub
-        run: |
-          export HUB_VERSION="2.14.2"
-          curl -fsSL https://github.com/github/hub/raw/8d91904208171b013f9a9d1175f4ab39068db047/script/get | bash -s "${HUB_VERSION}"
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Create release
         env:
@@ -29,8 +23,8 @@ jobs:
           echo "See [CHANGELOG.md](https://github.com/${GITHUB_REPOSITORY}/blob/${TAG_NAME}/CHANGELOG.md) for more details." > ./release_notes.md
           RELEASE_NAME="$(jq -r '.name' ./package.json)"
           sed -i "1i${RELEASE_NAME} ${TAG_NAME}\n" ./release_notes.md
-          ./bin/hub release create \
+          gh release create "${TAG_NAME}" \
             --draft \
             --prerelease \
-            --file ./release_notes.md \
-            "${TAG_NAME}"
+            --notes-file ./release_notes.md \
+            --title "${RELEASE_NAME} ${TAG_NAME}"

.github/workflows/test-action.yml

@@ -1,38 +1,39 @@
-name: Daily Test
+name: Test Action
 
 on:
-  schedule:
-    - cron: '13 13 * * *'
+  push:
+    branches: [main, feat/node24]
+  pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test:
-    runs-on: ${{ matrix.os }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
     strategy:
       matrix:
-        os:
-          - 'ubuntu-20.04'
-          - 'ubuntu-latest'
-          - 'macos-latest'
-          - 'windows-latest'
-        hugo-version:
-          - 'latest'
-          - '0.61.0'
-        extended:
-          - true
-          - false
+        hugo-version: ['latest', '0.160.1']
+        extended: [true, false]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - run: npm ci
+
+      - run: npm run build
 
       - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2.6.0
+        uses: ./
         with:
           hugo-version: ${{ matrix.hugo-version }}
           extended: ${{ matrix.extended }}
 
-      - name: Run hugo version
-        run: echo "::set-output name=hugo_version::$(hugo version)"
-        id: hugo_version
-
-      - name: '${{ steps.hugo_version.outputs.hugo_version }}'
-        run: echo '${{ steps.hugo_version.outputs.hugo_version }}'
+      - name: Verify Hugo
+        run: hugo version

.github/workflows/test.yml

@@ -10,22 +10,24 @@ on:
     paths-ignore:
       - '**.md'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
         os:
-          - 'ubuntu-22.04'
-          - 'ubuntu-20.04'
-          - 'ubuntu-latest'
+          - 'ubuntu-24.04'
           - 'macos-latest'
           - 'windows-latest'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
@@ -33,23 +35,23 @@ jobs:
       - run: npm ci
 
       - name: Run prettier
-        if: startsWith(matrix.os, 'ubuntu-22.04')
+        if: matrix.os == 'ubuntu-24.04'
         run: npm run format:check
 
       - name: Run eslint
-        if: startsWith(matrix.os, 'ubuntu-22.04')
+        if: matrix.os == 'ubuntu-24.04'
         run: npm run lint
 
       - name: Run ncc
-        if: startsWith(matrix.os, 'ubuntu-22.04')
+        if: matrix.os == 'ubuntu-24.04'
         run: npm run build
 
       - run: npm test
 
       - name: Upload test coverage as artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: coverage-${{ matrix.os }}
           path: coverage
 
-      - uses: codecov/codecov-action@v3
+      - uses: codecov/codecov-action@aa56896cf108bd10b5eb883cd1d24196da57f695 # v5.5.4

.github/workflows/update-major-tag.yml

@@ -4,17 +4,20 @@ on:
   release:
     types: [released]
 
+permissions:
+  contents: write
+
 jobs:
   update:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Update major tag
         run: |
           git config user.name "${GITHUB_ACTOR}"
           git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
-          git remote set-url origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${GITHUB_REPOSITORY}.git"
           export TAG_NAME="${GITHUB_REF##refs/tags/}"
           export TAG_MAJOR="${TAG_NAME%%.*}"
           git tag --force -a "${TAG_MAJOR}" -m "Release ${TAG_NAME}"

AGENTS.md

@@ -0,0 +1,31 @@
+# Repository Guidelines
+
+## Project Structure & Module Organization
+
+This repository contains a TypeScript GitHub Action for installing Hugo. Runtime source lives in `src/`, with `src/index.ts` as the action entry and `src/main.ts` coordinating input handling and installation. Tests live in `__tests__/`, with fixtures in `__tests__/data/`. The action metadata is `action.yml`; it points to the bundled output `lib/index.js`, which is generated by `npm run build`. Workflow automation is under `.github/workflows/`, and project imagery is in `images/`.
+
+## Build, Test, and Development Commands
+
+- `npm ci`: install dependencies from `package-lock.json`.
+- `npm run all`: run format check, ESLint, and Jest tests; use this before opening a PR.
+- `npm test`: run Jest with coverage and verbose output.
+- `npm run lint` / `npm run lint:fix`: check or fix TypeScript lint issues.
+- `npm run format:check` / `npm run format`: check or apply Prettier formatting for `*.ts`.
+- `npm run build`: bundle `src/index.ts` into `lib/` with `ncc`.
+- `make build`, `make test`, `make all`: run the Docker-based development image and test flow.
+
+## Coding Style & Naming Conventions
+
+Use TypeScript with `strict` and `noImplicitAny` enabled. Follow the existing Prettier settings: 2-space indentation, single quotes, semicolons, 100-column print width, no trailing commas, and no bracket spacing. Use named exports for reusable helpers, keep filenames lowercase with hyphenated words such as `get-latest-version.ts`, and keep tests named `*.test.ts`. Makefiles use tabs, as defined in `.editorconfig`.
+
+## Testing Guidelines
+
+Jest with `ts-jest` and `jest-circus` runs all `**/*.test.ts` files in a Node environment. Add focused unit tests next to related behavior in `__tests__/`, and place mocked API responses or reusable input data in `__tests__/data/`. Preserve or improve coverage when changing installer logic, URL generation, OS/arch detection, or latest-version lookup.
+
+## Commit & Pull Request Guidelines
+
+Commit history follows short Conventional Commit-style prefixes such as `feat:`, `ci:`, and `docs:`. Keep commit subjects imperative and scoped to one change. PRs should describe the behavior change, mention linked issues when applicable, and list verification commands such as `npm run all` and `npm run build`. Include updates to `README.md`, `action.yml`, and tests whenever inputs, runtime behavior, or documented examples change.
+
+## Agent-Specific Instructions
+
+Use English for repository-facing content, including documentation, code comments, commit messages, and pull request text, unless the task explicitly requires another language.

README.md

@@ -91,7 +91,7 @@ jobs:
           fetch-depth: 0    # Fetch all history for .GitInfo and .Lastmod
 
       - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
+        uses: peaceiris/actions-hugo@v3
         with:
           hugo-version: '0.119.0'
           # extended: true
@@ -121,7 +121,7 @@ Set `extended: true` to use a Hugo extended version.
 
 ```yaml
 - name: Setup Hugo
-  uses: peaceiris/actions-hugo@v2
+  uses: peaceiris/actions-hugo@v3
   with:
     hugo-version: '0.119.0'
     extended: true
@@ -133,7 +133,7 @@ Set `hugo-version: 'latest'` to use the latest version of Hugo.
 
 ```yaml
 - name: Setup Hugo
-  uses: peaceiris/actions-hugo@v2
+  uses: peaceiris/actions-hugo@v3
   with:
     hugo-version: 'latest'
 ```
@@ -151,13 +151,27 @@ This action fetches the latest version of Hugo by [hugo | Homebrew Formulae](htt
 ### ⭐️ Caching Hugo Modules
 
 Insert a cache step before site-building as follows.
-Note that with latest hugo version, the [cache dir location](https://gohugo.io/getting-started/configuration/#configure-cachedir) on a Linux-based operating system is `${HOME}/.cache`. On macOS, `${HOME}/Library/Caches` has the location.
+
+First, to maximize compatibility with all Hugo versions, let's define the variable `HUGO_CACHEDIR`:
 
 ```yaml
-- uses: actions/cache@v3
+# * ...
+
+jobs:
+  deploy:
+    runs-on: ubuntu-22.04
+    env:
+      HUGO_CACHEDIR: /tmp/hugo_cache # <- Define the env variable here, so that Hugo's cache dir is now predictible in your workflow and doesn't depend on the Hugo's version you're using.
+
+# * ...
+```
+
+Now, let's add the cache action call just above the _Build_ step:
+
+```yaml
+- uses: actions/cache@v4
   with:
-    path: /home/runner/.cache/hugo_cache    # <-- with hugo version v0.116.0 and above
-    # path: /tmp/hugo_cache                 # <-- with hugo version < v0.116.0
+    path: ${{ env.HUGO_CACHEDIR }} # <- Use the same env variable just right here
     key: ${{ runner.os }}-hugomod-${{ hashFiles('**/go.sum') }}
     restore-keys: |
       ${{ runner.os }}-hugomod-
@@ -190,7 +204,7 @@ Next, add a step to read a Hugo version from the `.env` file.
         echo "HUGO_VERSION=${HUGO_VERSION}" >> "${GITHUB_OUTPUT}"
 
     - name: Setup Hugo
-      uses: peaceiris/actions-hugo@v2
+      uses: peaceiris/actions-hugo@v3
       with:
         hugo-version: '${{ steps.hugo-version.outputs.HUGO_VERSION }}'
         extended: true
@@ -256,7 +270,7 @@ jobs:
           fetch-depth: 0         # Fetch all history for .GitInfo and .Lastmod
 
       - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
+        uses: peaceiris/actions-hugo@v3
         with:
           hugo-version: '0.119.0'
           extended: true
@@ -310,7 +324,7 @@ jobs:
           fetch-depth: 0    # Fetch all history for .GitInfo and .Lastmod
 
       - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
+        uses: peaceiris/actions-hugo@v3
         with:
           hugo-version: '0.119.0'
           extended: true
@@ -364,7 +378,7 @@ jobs:
         run: git config core.quotePath false
 
       - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
+        uses: peaceiris/actions-hugo@v3
         with:
           hugo-version: '0.119.0'
 ```

action.yml

@@ -11,7 +11,7 @@ inputs:
     required: false
     default: 'false'
 runs:
-  using: 'node20'
+  using: 'node24'
   main: 'lib/index.js'
 branding:
   icon: 'package'

package-lock.json

@@ -6,7 +6,7 @@
   "packages": {
     "": {
       "name": "actions-hugo",
-      "version": "2.6.0",
+      "version": "3.0.0",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {