feat: add prepare-command to hugo-ci for generating data before the build

.github/workflows/hugo-ci.yaml

@@ -25,6 +25,18 @@ on:
         description: Name for an artifact of public/, for later jobs in the same run. Empty skips the upload.
         type: string
         default: ""
+      prepare-command:
+        description: Shell command to run before Hugo builds, e.g. to generate files in data/. Runs with Node available and no npm install. Empty skips it.
+        type: string
+        default: ""
+      node-version:
+        description: Node.js version for prepare-command.
+        type: string
+        default: "24"
+    secrets:
+      prepare-secret:
+        description: Exposed to prepare-command as the PREPARE_SECRET environment variable, and to no other step.
+        required: false
 
 permissions: {}
 
@@ -45,6 +57,21 @@ jobs:
           fetch-depth: ${{ inputs.git-info && '0' || '1' }}
           filter: ${{ inputs.git-info && 'blob:none' || '' }}
 
+      - name: Setup Node
+        if: inputs.prepare-command != ''
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ inputs.node-version }}
+
+      # Runs before any dependency install, so no third-party package code
+      # shares the job with PREPARE_SECRET.
+      - name: Prepare
+        if: inputs.prepare-command != ''
+        run: bash -euo pipefail -c "$PREPARE_COMMAND"
+        env:
+          PREPARE_COMMAND: ${{ inputs.prepare-command }}
+          PREPARE_SECRET: ${{ secrets.prepare-secret }}
+
       - name: Setup Hugo
         uses: peaceiris/actions-hugo@2752ce1d29631191ea3f27c23495fa06139a5b78 # v3.2.1
         with:

docs/hugo-ci.md

@@ -11,6 +11,14 @@ Builds a Hugo site. Its job reports as the `build-site` check; called from a job
 | `ref` | triggering commit | Commit, branch, or tag to build; promote passes the resolved deploy commit |
 | `base-url` | site config | Override Hugo's `baseURL`, e.g. `http://localhost:4173/` for a11y |
 | `upload-artifact` | none | Artifact name for `public/`; empty skips the upload |
+| `prepare-command` | none | Shell command run before Hugo, e.g. to write `data/` files; empty skips it |
+| `node-version` | `24` | Node.js version available to `prepare-command` |
+
+| Secret | Purpose |
+|---|---|
+| `prepare-secret` | Optional. Available to `prepare-command` as `$PREPARE_SECRET`, and to no other step |
+
+`prepare-command` runs right after checkout, with Node installed and nothing else: there is no `npm ci`, so no third-party package code runs in the step that can see `prepare-secret`. A script that needs only Node's built-in modules fits this best.
 
 ## Example: build and scan a Hugo site
 
@@ -49,4 +57,21 @@ jobs:
 
 Required checks: `build / build-site` and `a11y / pa11y`.
 
+## Example: generate data before building
+
+Pass a secret only to the prepare step, under the name your script expects:
+
+```yaml
+jobs:
+  build:
+    permissions:
+      contents: read # Clone the repository
+    uses: meridth/workflows/.github/workflows/hugo-ci.yaml@<sha> # v1.4.0
+    with:
+      upload-artifact: site
+      prepare-command: FEED_URL="$PREPARE_SECRET" node scripts/fetch-data.mjs
+    secrets:
+      prepare-secret: ${{ secrets.FEED_URL }}
+```
+
 Pin to a release commit SHA with the version in a comment, as shown. See [Releases](https://github.com/meridth/workflows/releases).