From 2c97ab386b56f69dff7cec977614a538acff9ff1 Mon Sep 17 00:00:00 2001
From: Magnus Madsen <magnusm@cs.au.dk>
Date: Sat, 8 Aug 2026 20:38:37 +0200
Subject: [PATCH] ci: use prebuilt Zola 0.22.1 binary instead of building from
 source

The build workflow pinned Zola v0.19.2 and compiled it with `cargo
install`, which required two extra checkouts (one sparse, just to hash
Zola's Cargo.lock for a cache key) and a cargo cache to keep cold builds
from dominating CI time.

Zola publishes official release tarballs, so download and install one
instead. This removes the extra checkouts, the cargo cache, and the Rust
build entirely. The release artifacts are signed with Sigstore, so verify
the download with `gh attestation verify` before installing it.

Also:

- Bump Zola 0.19.2 -> 0.22.1. The only breaking change in that range is
  0.22.0 replacing the Syntect highlighter with Giallo and moving its
  config under [markdown.highlighting]. This site has no [markdown]
  section, so built-in highlighting is off and highlight.js from static/
  is used instead. Not going to 0.23.x: it removes shortcodes, which tabi
  depends on.
- Bump actions/checkout v5 -> v7.
- Drop the blog-site/ subdirectory checkout and both working-directory
  settings, now that Zola's source is no longer checked out beside the
  site.
- Scope `tree .` to `tree public` and drop the cat of one hardcoded post,
  which would break CI on a rename.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/build.yaml | 56 +++++++++++-------------------------
 1 file changed, 16 insertions(+), 40 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index b79fb57..fd9f054 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -11,56 +11,32 @@ concurrency:
   group: build-${{ github.ref }}
 
 env:
-  CARGO_TERM_COLOR: always
+  ZOLA_VERSION: 0.22.1
 
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       - name: Check out PR
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
-          path: blog-site
           submodules: true
-      - name: Set Zola version
-        id: zola-version
-        run: echo "version=v0.19.2" >> $GITHUB_OUTPUT
-      - name: Check out Zola cargo lock (for cache key)
-        uses: actions/checkout@v5
-        with:
-          repository: getzola/zola
-          ref: ${{ steps.zola-version.outputs.version }}
-          path: zola-cargo
-          sparse-checkout: |
-            Cargo.lock
-          sparse-checkout-cone-mode: false
-      - name: Restore cached cargo builds
-        id: cargo-cache
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('zola-cargo/Cargo.lock') }}
-      - name: Conditionally check out Zola (if version changed)
-        if: ${{ steps.cargo-cache.outputs.cache-hit != 'true' }}
-        uses: actions/checkout@v5
-        with:
-          submodules: true
-          repository: getzola/zola
-          ref: ${{ steps.zola-version.outputs.version }}
-          path: zola
-      - name: Conditionally build Zola (if no cached binary was found)
-        if: ${{ steps.cargo-cache.outputs.cache-hit != 'true' }}
-        run: cargo install --path zola/
+      - name: Install Zola
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          archive=zola-v${ZOLA_VERSION}-x86_64-unknown-linux-gnu.tar.gz
+          curl -sSfL -o "$archive" \
+            "https://github.com/getzola/zola/releases/download/v${ZOLA_VERSION}/${archive}"
+          # The release artifacts are signed with Sigstore; refuse anything unattested.
+          gh attestation verify "$archive" --repo getzola/zola
+          tar -xzf "$archive" zola
+          sudo install -m 755 zola /usr/local/bin/zola
+          rm "$archive" zola
+          zola --version
       - name: Build site
         run: make
-        working-directory: ./blog-site
       - name: Show build output
         run: |
-          tree .
+          tree public
           cat public/404.html
-          cat public/blog/design-flaws-in-flix/index.html
-        working-directory: ./blog-site