ci: use prebuilt Zola 0.22.1 binary instead of building from source

[magnus-madsen]

The build workflow pinned Zola v0.19.2 and compiled it with cargo install. That needed two extra checkouts — one of them a sparse checkout existing only to hash Zola's Cargo.lock into a cache key — plus a cargo cache to stop cold builds from dominating CI time.

Zola publishes official release tarballs, so this downloads and installs one instead. The extra checkouts, the cargo cache, and the Rust build all go away; CI drops from minutes to seconds and the cache-invalidation logic disappears with it.

Supply chain

Zola signs its release artifacts with Sigstore, so the download is checked with gh attestation verify before it is installed. Verified locally: the real tarball passes (exit 0), the same tarball with one byte appended fails (exit 1). gh is preinstalled on ubuntu-latest and github.token covers the API call.

Zola 0.19.2 -> 0.22.1

The only breaking change in that range is 0.22.0 replacing the Syntect highlighter with Giallo and moving highlighting config under [markdown.highlighting]. This site has no [markdown] section at all, so built-in highlighting is off and highlight.js from static/ is used instead. (themes/tabi/config.toml does set highlight_code = true, but that file is the theme's example config and is never merged into the site config.) Built locally with Zola 0.22.1: 8 pages, 2 sections, no warnings.

Deliberately not going to 0.23.x, which is out. Upstream calls it "probably the most breaking version of Zola that will happen" — Tera v2 and shortcodes removed entirely. tabi is built on shortcodes, so that upgrade is blocked on the theme.

Also in this change

• actions/checkout v5 -> v7. The only behavior change is v7 blocking fork-PR checkout under pull_request_target/workflow_run, neither of which this workflow uses.
• Dropped the blog-site/ subdirectory checkout and both working-directory: settings, which only existed because Zola's source was checked out beside the site.
• Scoped tree . to tree public (it was dumping the whole repo including the vendored theme) and dropped the cat of one hardcoded post path, which would fail CI on a rename. The 404.html cat stayed.
• Kept submodules: true even though .gitmodules is empty and tabi is vendored — it is a no-op today and protects the build if tabi ever returns to being a submodule.

Note

This workflow only builds; it never deploys, and there is no netlify.toml/vercel.json in the repo. If whatever publishes blog.flix.dev pins its own Zola version, that needs bumping to 0.22.1 separately.

🤖 Generated with Claude Code