Hugo v0.111.0 (and Alpine v3.17)

The failure occurs when a git operation triggers recently added safe directory checks to alert the user when there is a UID or GID mismatch.  Because the ENTRYPOINT of the hugo-extended container is a call to `hugo`, there is no ability for the end user of the container to tell git to trust the /src directory before hugo is started.

It is possible to override the UID and GID when using the container, but this causes permission errors and does not seem like a user-friendly path forward.

After this change, the hugo-extended container will contain a global git configuration to trust the /src directory.  This may have security implications that have not been considered, but since only the project directory is mounted to /src, this approach seems to respect the intent of git safe directory checks.

.github/workflows/build.yml

@@ -14,7 +14,7 @@ jobs:
     if: "!contains(github.event.head_commit.message, '[skip ci]')"
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Prepare tags
         id: tag
@@ -34,16 +34,16 @@ jobs:
           echo ::set-output name=tags::${TAGS}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@master
+        uses: docker/setup-qemu-action@v2
         with:
-          platforms: all
+          platforms: linux/amd64,linux/arm64
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@master
+        uses: docker/setup-buildx-action@v2
 
       - name: Cache Docker layers
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
           path: /tmp/.buildx-cache
           key: ${{ runner.os }}-buildx-${{ github.sha }}
@@ -52,14 +52,14 @@ jobs:
 
       - name: Login to DockerHub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           username: jakejarvis
           password: ${{ secrets.DOCKER_HUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -67,7 +67,7 @@ jobs:
 
       - name: Build and push
         id: build
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v3
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: ./

Dockerfile

@@ -1,14 +1,15 @@
 # the following version can be overridden at image build time with --build-arg
-ARG HUGO_VERSION=0.84.4
+ARG HUGO_VERSION=0.111.0
 # remove/comment the following line completely to compile vanilla Hugo:
 ARG HUGO_BUILD_TAGS=extended
 
 # Hugo >= v0.81.0 requires Go 1.16+ to build
-ARG GO_VERSION=1.16
+ARG GO_VERSION=1.19
+ARG ALPINE_VERSION=3.17
 
 # ---
 
-FROM golang:${GO_VERSION}-alpine3.13 AS build
+FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS build
 
 # renew global args from above
 # https://docs.docker.com/engine/reference/builder/#scope
@@ -27,8 +28,7 @@ RUN apk add --update --no-cache \
       gcc \
       g++ \
       musl-dev \
-      git && \
-    go get github.com/magefile/mage
+      git
 
 # clone source from Git repo:
 RUN git clone \
@@ -37,23 +37,25 @@ RUN git clone \
       --depth 1 \
       https://github.com/gohugoio/hugo.git ./
 
-RUN mage -v hugo && mage install
+# https://github.com/gohugoio/hugo/commit/241481931f5f5f2803cd4be519936b26d8648dfd
+RUN go build -v -ldflags "-X github.com/gohugoio/hugo/common/hugo.vendorInfo=docker" -tags "$HUGO_BUILD_TAGS" && \
+    mv ./hugo /go/bin/hugo
 
 # fix potential stack size problems on Alpine
 # https://github.com/microsoft/vscode-dev-containers/blob/fb63f7e016877e13535d4116b458d8f28012e87f/containers/hugo/.devcontainer/Dockerfile#L19
-RUN go get github.com/yaegashi/muslstack && \
+RUN go install github.com/yaegashi/muslstack@latest && \
     muslstack -s 0x800000 /go/bin/hugo
 
 # ---
 
-FROM alpine:3.13
+FROM alpine:${ALPINE_VERSION}
 
 # renew global args from above & pin any dependency versions
 ARG HUGO_VERSION
 # https://github.com/jgm/pandoc/releases
-ARG PANDOC_VERSION=2.14
+ARG PANDOC_VERSION=2.19.2
 # https://github.com/sass/dart-sass-embedded/releases
-ARG DART_SASS_VERSION=1.0.0-beta.7
+ARG DART_SASS_VERSION=1.58.3
 
 LABEL version="${HUGO_VERSION}"
 LABEL repository="https://github.com/jakejarvis/hugo-docker"
@@ -120,6 +122,8 @@ RUN set -euo pipefail && \
     fi && \
     # clean up some junk
     rm -rf /tmp/* /var/tmp/* /var/cache/apk/* && \
+    # tell git to trust /src
+    git config --global --add safe.directory /src && \
     # make super duper sure that everything went OK, exit otherwise
     hugo env && \
     go version && \