The vendored theme records no upstream ref, so it cannot be moved, diffed, or audited

[ptr727]

Found while reviewing this pipeline against the new fleet hugo type (ptr727/ProjectTemplate#560), which asserts hugo.vendored.provenance.

What is there

themes/PaperMod is 125 tracked files, including the upstream repo's own .github/workflows/build-check.yml, committed wholesale in a single commit (b7c5590 Import blog.insanegenius.com as a Hugo site).

• No .gitmodules; git submodule status is empty.
• No recorded upstream ref, tag, or commit anywhere. themes/PaperMod/theme.toml carries name, license, and homepage only, no version.
• No Dependabot ecosystem covers it. .github/dependabot.yml:3 states github-actions is the only ecosystem this repo ships, and :4 records the reason as "the theme is vendored rather than pulled by a manager".

The vendoring decision itself is stated in three places and is defensible. The gap is narrower than the decision: nothing records which upstream commit this is a copy of.

Why it matters

Without a recorded ref there is no way to answer "what changed upstream since we took this", "does this carry a fix we need", or "is our local modification still necessary". The fleet already requires a 40-hex SHA for every action and a committed state file for every upstream pin. A 125-file vendored tree with no recorded origin is the same hazard with a much larger surface.

This is not hypothetical here. TODO.md:86 records that PaperMod uses APIs Hugo deprecated in 0.158, so --panicOnWarning fails on the theme rather than on content, and two layouts/ overrides exist to keep that flag usable. Deciding whether those overrides can be dropped means diffing against a specific upstream revision, and there is currently nothing to diff against.

Two ways to close it

1. Record the provenance. A committed record naming the upstream repository and the exact commit the copy was taken from, plus the local modifications and why. Satisfies the check, keeps the vendoring, cheapest.
2. Convert to a submodule. Stronger: it pins by construction and brings Dependabot's gitsubmodule ecosystem, so theme bumps become normal dual-targeted bot PRs the merge-bot auto-merges and CI validates. Costs a --recurse-submodules on every checkout in the pipeline, and the --panicOnWarning overrides still need their own home.

Option 1 is enough to clear the check. Option 2 is what actually keeps the theme current, and is worth considering given the deprecation situation above.

Recorded in the hub registry as a driftNote against hugo.vendored.provenance until it clears.

[ptr727]

Fixed in 49dfbbc on develop (#30). Closing manually because the PR targeted develop rather than the default branch, so the keyword will not fire until promotion.

themes/README.md records the provenance. The commit was recovered rather than guessed: hashing all 125 tracked blobs and matching them against upstream history identified 154d006e0182dfc7da38008323976b02e6bfab4a (2026-05-10, describing as v8.0-138-g154d006), with every file matching exactly except two.

Those two are additions in extension points the theme documents for the purpose rather than forks of theme logic:

File	Edit
assets/css/extended/blank.css	ships empty; carries the Lexend body font and the gallery-cols-* rules
layouts/_partials/extend_head.html	ships empty; carries the Google Fonts links

The record notes both could live at the project root instead, since Hugo resolves a project's own assets/css/extended/ and layouts/_partials/ ahead of the theme's. Moving them at the next update would make it a clean directory replace with nothing to reapply. Left for that update rather than done here.

It sits at themes/README.md, outside PaperMod/, so replacing that directory does not take it with it.

One thing this fix exposed: the markdown glob excluded all of themes/, so a file we author about a vendored tree would not have been linted. It now excludes themes/*/**, reaching inside a theme rather than over the directory holding them.

What this now makes answerable, and did not before: TODO.md records that PaperMod uses APIs Hugo deprecated in 0.158, which is why two layouts/ overrides exist to keep --panicOnWarning usable. Whether they are still needed is a diff against the recorded commit.