This is where the DOI community manages the organization's main website. CNRI is the sysadmin and Cazinc is the webadmin. Roles refined as:
- DNS
- Hosting - endpoints - www.doi.org + staging.doi.org
- APIs such as stats (no. DOIs, no. resolutions)
- Certificate
- Programming
- CSS
- Editorial support
- Tech support
- Analytics
Push staging and the Action in .github/workflows/build.yml builds to https://staging.doi.org/. Push main and it goes to https://www.doi.org/. Each job passes --baseURL so links match that host. The baseURL in config.toml is only for local work.
The deploy will not delete more than 256 files from the bucket, and it stops if public/ has fewer than 1500 files. A good build is a bit over 2400. We used to pass --maxDeletes -1, which would have emptied the live bucket if a build went thin. If you really need to delete a lot of files, raise --maxDeletes in that PR and put it back afterwards.
Staging sits behind CloudFront only, and hugo deploy invalidates it (invalidateCDN in config.toml).
Live sits behind Cloudflare, which fetches from CloudFront. Hugo can't purge Cloudflare, so the live job does both caches itself after the deploy. It invalidates CloudFront, waits for that to finish, and then purges www.doi.org from Cloudflare. If Cloudflare were purged first it would just fetch the old pages from CloudFront again. The purge is by hostname, so the rest of the doi.org zone is not touched.
The live job needs these repo secrets:
AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, alloweds3writes pluscloudfront:CreateInvalidationandcloudfront:GetInvalidationCLOUDFLARE_API_TOKEN, a token with only Zone → Cache Purge on the doi.org zoneCLOUDFLARE_ZONE_ID, the doi.org zone ID
Hugo 0.137 pulled hugo deploy out of the extended binary, so S3 deploys need the extended_withdeploy build. peaceiris/actions-hugo still cannot install that. We ran a fork (deining/actions-hugo) that could, but it is stuck on Node 20, and GitHub hosted runners drop Node 20 on 16 September 2026. After that the fork just fails. Upstream is on Node 24 now and still has no withdeploy.
The workflow grabs the official Linux tarball from Hugo's releases and checks the SHA-256 against the sums file in that release. Checkout is actions/checkout@v6, which runs on Node 24. v2 and v4 still use Node 20.
HUGO_VERSION at the top of build.yml is the pin. Don't set it to latest. We already got caught once when a Hugo release changed the build (0.162 started blocking HTML content files). Try the new version locally first, then bump the pin.
Late 2025, early 2026 the DOI Handbook pages became automatically generated via an XSLT file that takes the xml contents and formats them in an easily navigable interactive HTML structure. Any updates to the source handbook XML can be dropped into the repo at
replacing the existing DOIHandbook.xml and the following build/deploy will update onto the staging/live site.
New features in the XML file itself (eg specific highlighting of a term/paragraph) would need coded for in the handbook-html.xslt file.