feat: use htmltrust-hugo module + spec-conformant signer in CI #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| build: | |
| name: Build and sign | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: true | |
| - name: Setup Hugo | |
| uses: peaceiris/actions-hugo@v3 | |
| with: | |
| hugo-version: "latest" | |
| extended: true | |
| - name: Setup Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.22' | |
| - name: Build | |
| run: hugo --minify | |
| - name: Verify placeholder signed-sections exist | |
| run: | | |
| count=$(grep -rl '<signed-section' public/ | wc -l) | |
| echo "Found $count pages with <signed-section> placeholders" | |
| if [ "$count" -lt 4 ]; then | |
| echo "ERROR: Expected at least 4 pages with signed-section placeholders" | |
| exit 1 | |
| fi | |
| - name: Install htmltrust-sign | |
| run: go install github.com/HTMLTrust/htmltrust-hugo/cmd/htmltrust-sign@latest | |
| - name: Sign content | |
| env: | |
| HTMLTRUST_SIGNING_KEY: ${{ secrets.HTMLTRUST_SIGNING_KEY }} | |
| run: | | |
| htmltrust-sign --dir public --keyid did:web:jason-grey.com --domain www.htmltrust.org -v | |
| - name: Verify signed sections are complete | |
| run: | | |
| if grep -rq 'data-htmltrust-placeholder' public/; then | |
| echo "ERROR: placeholder markers remain - signer did not run on all sections" | |
| exit 1 | |
| fi | |
| for f in $(grep -rl '<signed-section' public/); do | |
| if ! grep -q 'content-hash="sha256:' "$f"; then echo "MISSING content-hash in $f"; exit 1; fi | |
| if ! grep -q 'signature="' "$f"; then echo "MISSING signature in $f"; exit 1; fi | |
| if ! grep -q 'keyid="did:web:' "$f"; then echo "MISSING keyid in $f"; exit 1; fi | |
| if ! grep -q 'algorithm="ed25519"' "$f"; then echo "MISSING algorithm in $f"; exit 1; fi | |
| done | |
| echo "OK: all signed-section elements carry the four spec-required attributes" | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: website | |
| path: public/ | |
| deploy: | |
| name: Deploy to Cloudflare Pages | |
| runs-on: ubuntu-latest | |
| needs: build | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| steps: | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| name: website | |
| path: public/ | |
| - name: Deploy to Cloudflare Pages | |
| uses: cloudflare/wrangler-action@v3 | |
| with: | |
| apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| command: pages deploy public --project-name=htmltrust-website |