ci: fetch annotated tag object in release workflow (#3) #10

	name: ci

	on:
	pull_request:
	branches: [main]
	push:
	branches: [main]

	permissions:
	contents: read

	# The theme owns its own lint + typecheck for the JS assets under
	# assets/js/, and builds exampleSite/ as a sanity gate so broken SCSS
	# imports or template syntax errors surface before downstream consumers
	# bump to a new version.

	jobs:
	build:
	runs-on: ubuntu-latest
	env:
	HUGO_VERSION: "0.160.1"
	steps:
	# Checkout into a directory named "pager" so exampleSite/hugo.toml
	# (theme = "pager") can resolve the theme under --themesDir ../..
	# without a rename step.
	- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
	with:
	path: pager

	- name: Install Hugo extended
	run: \|
	wget -q -O /tmp/hugo.deb \
	"https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-amd64.deb"
	sudo dpkg -i /tmp/hugo.deb
	hugo version

	- name: Build exampleSite
	working-directory: pager/exampleSite
	run: hugo --minify --gc --themesDir ../.. --destination public

	lint:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
	- uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
	with:
	node-version: '22'
	cache: npm
	- name: Install npm devDependencies
	# --ignore-scripts blocks postinstall hooks so a malicious
	# package-lock.json change cannot execute code during install.
	run: npm ci --include=dev --ignore-scripts
	- name: ESLint
	run: npm run lint
	- name: TypeScript check
	run: npm run typecheck

Provide feedback