From cb892bd9a7c2ea636f9214778572288947cf2c60 Mon Sep 17 00:00:00 2001
From: jmeridth <jmeridth@gmail.com>
Date: Wed, 30 Sep 2026 23:52:50 -0500
Subject: [PATCH] feat: add prepare-command to hugo-ci for generating data
 before the build

Signed-off-by: jmeridth <jmeridth@gmail.com>
---
 .github/workflows/hugo-ci.yaml | 27 +++++++++++++++++++++++++++
 docs/hugo-ci.md                | 25 +++++++++++++++++++++++++
 2 files changed, 52 insertions(+)

diff --git a/.github/workflows/hugo-ci.yaml b/.github/workflows/hugo-ci.yaml
index 11cf0f5..3761ef5 100644
--- a/.github/workflows/hugo-ci.yaml
+++ b/.github/workflows/hugo-ci.yaml
@@ -25,6 +25,18 @@ on:
         description: Name for an artifact of public/, for later jobs in the same run. Empty skips the upload.
         type: string
         default: ""
+      prepare-command:
+        description: Shell command to run before Hugo builds, e.g. to generate files in data/. Runs with Node available and no npm install. Empty skips it.
+        type: string
+        default: ""
+      node-version:
+        description: Node.js version for prepare-command.
+        type: string
+        default: "24"
+    secrets:
+      prepare-secret:
+        description: Exposed to prepare-command as the PREPARE_SECRET environment variable, and to no other step.
+        required: false
 
 permissions: {}
 
@@ -45,6 +57,21 @@ jobs:
           fetch-depth: ${{ inputs.git-info && '0' || '1' }}
           filter: ${{ inputs.git-info && 'blob:none' || '' }}
 
+      - name: Setup Node
+        if: inputs.prepare-command != ''
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ inputs.node-version }}
+
+      # Runs before any dependency install, so no third-party package code
+      # shares the job with PREPARE_SECRET.
+      - name: Prepare
+        if: inputs.prepare-command != ''
+        run: bash -euo pipefail -c "$PREPARE_COMMAND"
+        env:
+          PREPARE_COMMAND: ${{ inputs.prepare-command }}
+          PREPARE_SECRET: ${{ secrets.prepare-secret }}
+
       - name: Setup Hugo
         uses: peaceiris/actions-hugo@2752ce1d29631191ea3f27c23495fa06139a5b78 # v3.2.1
         with:
diff --git a/docs/hugo-ci.md b/docs/hugo-ci.md
index 923cad5..81320f3 100644
--- a/docs/hugo-ci.md
+++ b/docs/hugo-ci.md
@@ -11,6 +11,14 @@ Builds a Hugo site. Its job reports as the `build-site` check; called from a job
 | `ref` | triggering commit | Commit, branch, or tag to build; promote passes the resolved deploy commit |
 | `base-url` | site config | Override Hugo's `baseURL`, e.g. `http://localhost:4173/` for a11y |
 | `upload-artifact` | none | Artifact name for `public/`; empty skips the upload |
+| `prepare-command` | none | Shell command run before Hugo, e.g. to write `data/` files; empty skips it |
+| `node-version` | `24` | Node.js version available to `prepare-command` |
+
+| Secret | Purpose |
+|---|---|
+| `prepare-secret` | Optional. Available to `prepare-command` as `$PREPARE_SECRET`, and to no other step |
+
+`prepare-command` runs right after checkout, with Node installed and nothing else: there is no `npm ci`, so no third-party package code runs in the step that can see `prepare-secret`. A script that needs only Node's built-in modules fits this best.
 
 ## Example: build and scan a Hugo site
 
@@ -49,4 +57,21 @@ jobs:
 
 Required checks: `build / build-site` and `a11y / pa11y`.
 
+## Example: generate data before building
+
+Pass a secret only to the prepare step, under the name your script expects:
+
+```yaml
+jobs:
+  build:
+    permissions:
+      contents: read # Clone the repository
+    uses: meridth/workflows/.github/workflows/hugo-ci.yaml@<sha> # v1.4.0
+    with:
+      upload-artifact: site
+      prepare-command: FEED_URL="$PREPARE_SECRET" node scripts/fetch-data.mjs
+    secrets:
+      prepare-secret: ${{ secrets.FEED_URL }}
+```
+
 Pin to a release commit SHA with the version in a comment, as shown. See [Releases](https://github.com/meridth/workflows/releases).