Adopt the Hub's Reusable validate-task.yml

.github/actions/validate/action.yml

@@ -0,0 +1,59 @@
+# Blog's own validate hook, run by the hub's validate-task.yml validate job.
+# The fleet doc-lint block and the generic unit-test job in validate-task.yml do not cover this repo's own domain checks.
+name: Validate repository (Blog)
+description: Config/env-docs checks and the Hugo build/URL-parity gate.
+
+runs:
+  using: composite
+  steps:
+
+    - name: Validate config step
+      shell: bash
+      run: |
+        set -Eeuo pipefail
+        for f in spec/*.json version.json .editorconfig-checker.json; do
+          jq empty "$f"
+        done
+        python3 -c 'import yaml,sys; yaml.safe_load(open("hugo.yaml"))'
+
+    # Every configuration value is described once, in ENVIRONMENT.md.
+    # A new value gets added wherever its author is working, and nothing else notices a missing row.
+    # This check runs both directions: undocumented values, and rows describing nothing.
+    - name: Check environment docs step
+      shell: bash
+      run: python3 checks/check-env-docs.py
+
+    # The hub's validate job checkout is shallow.
+    # The mtime restore below needs full history to date each file from its last commit.
+    # This hook deepens the checkout before the build.
+    - name: Deepen checkout step
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        ref: ${{ github.sha }}
+        fetch-depth: 0
+
+    # The pin lives in the action, so validation and the deploy cannot install different generators.
+    - name: Install Hugo step
+      uses: ./.github/actions/install-hugo
+
+    # The same action the deploy uses, so the two agree on who restores the mtimes.
+    - name: Restore file mtimes step
+      uses: chetan/git-restore-mtime-action@d186aca54f8760da4dec55313195e51ed3ebb0b3 # v2.3
+      with:
+        args: static
+
+    # This is the build and URL-contract gate, not an extra step beside one.
+    # The script runs `hugo --panicOnWarning` and check-url-parity itself, so a separate build would repeat both.
+    # --panicOnWarning is the real gate, and two PaperMod templates are overridden in layouts/ so it can stay on.
+    # Every local asset reference must resolve, and every legacy image URL from the WordPress import must too.
+    #
+    # Running the script here is also the point: it was linted and never run, so a broken caller contract reached a deploy.
+    # An empty scratch root exercises the deploy's path short of the transport, with no previous release for the hard-link guard.
+    # REQUIRE_BROTLI stays unset, since installing brotli would cost an apt round trip per pull request.
+    - name: Assemble release bundle step
+      shell: bash
+      env:
+        MTIME_RESTORED: '1'
+      run: |
+        set -Eeuo pipefail
+        deploy/make-release.sh "${RUNNER_TEMP}/validate-bundle" "$(date -u +%Y%m%d-%H%M%S)"

.github/workflows/deploy-site.yml

@@ -40,9 +40,19 @@ jobs:
   validate:
     name: Validate sources job
     needs: [ assert-ref ]
-    uses: ./.github/workflows/validate-task.yml
+    uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@cd7bae9ea830d2e42d1f7bb6e45b3e7f631c0668 # 2.0.448
     permissions:
       contents: read
+    with:
+      # This repo's whole Hugo content tree (content/) and the vendored PaperMod theme are both excluded here.
+      # .markdownlint-cli2.jsonc is carried verbatim, so it cannot scope them locally.
+      markdown-exclude-globs: |
+        !content/**
+        !themes/*/**
+      # The vendored theme stays byte-identical to upstream.
+      # Its own floating-tag action pins are never locally edited to satisfy this repo's sha-pin gate.
+      repo-gate-exclude-globs: |
+        themes/*/**
 
   deploy:
     name: Deploy site job

.github/workflows/publish-release.yml

@@ -23,20 +23,27 @@ jobs:
       actor: ${{ github.actor }}
       ref_name: ${{ github.ref_name }}
 
-  # The same reusable gate the PR runs - a dispatch cannot release a ref that fails validation.
-  # This repo's own validate-task.yml carries the Hugo build and URL-parity gate alongside the generic
-  # linters (see AGENTS.md/GOVERNANCE.md for why this repo has not yet adopted the hub-hosted validate-task.yml).
+  # The same reusable gate the pull request runs.
+  # A dispatch cannot release a ref that fails validation.
+  # No ref input to pin: the called workflow already checks out this run's dispatch-time github.sha by default.
+  # That is the same commit the publish job below builds.
   validate:
     name: Validate sources job
     needs: [plan]
     if: ${{ needs.plan.outputs.publish == 'true' }}
-    uses: ./.github/workflows/validate-task.yml
-    with:
-      # Pin the same dispatch-time commit publish below builds, so a push landing after dispatch
-      # cannot make validate and publish run against two different commits.
-      ref: ${{ github.sha }}
+    uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@cd7bae9ea830d2e42d1f7bb6e45b3e7f631c0668 # 2.0.448
     permissions:
       contents: read
+    with:
+      # This repo's whole Hugo content tree (content/) and the vendored PaperMod theme are both excluded here.
+      # .markdownlint-cli2.jsonc is carried verbatim, so it cannot scope them locally.
+      markdown-exclude-globs: |
+        !content/**
+        !themes/*/**
+      # The vendored theme stays byte-identical to upstream.
+      # Its own floating-tag action pins are never locally edited to satisfy this repo's sha-pin gate.
+      repo-gate-exclude-globs: |
+        themes/*/**
 
   # Publish the dispatched branch, where main is a release and develop a prerelease.
   # NBGV computes the tag; the release is the tag plus the auto source archive, README, and LICENSE.
@@ -50,7 +57,8 @@ jobs:
       contents: write
       actions: write
     with:
-      # Full history for NBGV; pin the dispatch-time commit - a push landing after dispatch must not release unvalidated.
+      # Full history for NBGV.
+      # Pin the dispatch-time commit, since a push landing after dispatch must not release unvalidated.
       ref: ${{ github.sha }}
       branch: ${{ github.ref_name }}
       smoke: false

.github/workflows/test-pull-request.yml

@@ -1,5 +1,9 @@
 name: Test pull request action
 
+# Thin caller: the gate is the hub's reusable validate-task.yml, which this repo reaches rather than carries.
+# This is a release-model repo with no build target, so the automatic trigger is pull_request only.
+# It has no direct-commit allowance to keep advisory.
+# A manual run stays available through workflow_dispatch.
 on:
   pull_request:
     branches: [ main, develop ]
@@ -9,14 +13,25 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
 
-  # The reusable validation gate (validate-task.yml) - the same job publish-release runs before a release.
   validate:
     name: Validate sources job
-    uses: ./.github/workflows/validate-task.yml
+    uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@cd7bae9ea830d2e42d1f7bb6e45b3e7f631c0668 # 2.0.448
     permissions:
       contents: read
+    with:
+      # This repo's whole Hugo content tree (content/) and the vendored PaperMod theme are both excluded here.
+      # .markdownlint-cli2.jsonc is carried verbatim, so it cannot scope them locally.
+      markdown-exclude-globs: |
+        !content/**
+        !themes/*/**
+      # The vendored theme stays byte-identical to upstream.
+      # Its own floating-tag action pins are never locally edited to satisfy this repo's sha-pin gate.
+      repo-gate-exclude-globs: |
+        themes/*/**
 
   # GitHub Actions does not support required status checks on conditional jobs.
   # A single always-run aggregator therefore gates the merge.