feat: support renamed Hugo release assets (#687)

## Summary
- Support multiple Hugo release asset names for Linux, macOS, and
Windows so renamed upstream assets no longer fail with a plain 404.
- Preserve compatibility with legacy Hugo assets that used filename
forms such as `hugo_v0.20.3_*`, macOS `.zip` archives, and
`Linux_ARM`-style names.
- Add retry handling for missing candidate assets and macOS `.pkg`
extraction via `pkgutil --expand-full`, with focused URL and installer
tests plus the rebuilt `lib/index.js` bundle.

## References
- Fixes https://github.com/peaceiris/actions-hugo/issues/652
- `hugo-version: latest` still resolves through Homebrew; this change
does not fall back to an older Hugo version when the resolved release
has no compatible asset.
- Review note: `lib/index.js` is generated by `npm run build` and
contains bundled dependency code.

## Test plan
- [x] `RUNNER_TEMP=/tmp npm run all`
- [x] `npm run build`


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Tests**
* Broadened test coverage for asset URL generation, download retry
behavior, and extraction across OSes and architectures.

* **Bug Fixes**
* More resilient installer with multiple candidate download URLs and
retry handling for transient failures.
* Improved extraction logic to correctly handle platform- and
format-specific archives.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/peaceiris/actions-hugo/pull/687)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Codex <noreply@openai.com>

src/installer.ts

@@ -1,12 +1,18 @@
 import * as core from '@actions/core';
 import * as tc from '@actions/tool-cache';
 import * as io from '@actions/io';
+import * as exec from '@actions/exec';
 import getOS from './get-os';
 import getArch from './get-arch';
 import getURL from './get-url';
 import * as path from 'path';
 import {Tool, Action} from './constants';
 
+export interface DownloadedAsset {
+  path: string;
+  url: string;
+}
+
 export function getHomeDir(): string {
   let homedir = '';
 
@@ -43,6 +49,66 @@ export async function createBinDir(workDir: string): Promise<string> {
   return binDir;
 }
 
+export function isRetryableDownloadError(error: unknown): boolean {
+  const message = error instanceof Error ? error.message : `${error}`;
+  return (
+    message.includes('Unexpected HTTP response: 404') ||
+    message.includes('Code(404)') ||
+    (message.includes('404') && message.includes('Not Found'))
+  );
+}
+
+export function isWindowsAsset(assetURL: string): boolean {
+  return /(?:Windows[-_]|windows[-_])/.test(assetURL);
+}
+
+export async function downloadHugoAsset(toolURLs: string[]): Promise<DownloadedAsset> {
+  for (const toolURL of toolURLs) {
+    core.debug(`toolURL: ${toolURL}`);
+
+    try {
+      return {
+        path: await tc.downloadTool(toolURL),
+        url: toolURL
+      };
+    } catch (error) {
+      if (!isRetryableDownloadError(error)) {
+        throw error;
+      }
+
+      core.debug(`Hugo asset not found at ${toolURL}`);
+    }
+  }
+
+  throw new Error(
+    `Unable to find a compatible Hugo release asset for this runner. Tried:\n${toolURLs.join('\n')}`
+  );
+}
+
+export async function extractHugoAsset(
+  assetPath: string,
+  assetURL: string,
+  tempDir: string,
+  binDir: string
+): Promise<void> {
+  let toolBin = '';
+
+  if (assetURL.endsWith('.zip')) {
+    const toolExtractedFolder: string = await tc.extractZip(assetPath, tempDir);
+    const toolCmd = isWindowsAsset(assetURL) ? `${Tool.CmdName}.exe` : Tool.CmdName;
+    toolBin = path.join(toolExtractedFolder, toolCmd);
+  } else if (assetURL.endsWith('.pkg')) {
+    const pkgExtractedFolder = path.join(tempDir, 'pkg');
+    await exec.exec('pkgutil', ['--expand-full', assetPath, pkgExtractedFolder]);
+    toolBin = path.join(pkgExtractedFolder, 'Payload', Tool.CmdName);
+  } else {
+    const toolExtractedFolder: string = await tc.extractTar(assetPath, tempDir);
+    toolBin = path.join(toolExtractedFolder, Tool.CmdName);
+  }
+
+  await io.mv(toolBin, binDir);
+}
+
 export async function installer(version: string): Promise<void> {
   const extended: string = core.getInput('extended');
   core.debug(`Hugo extended: ${extended}`);
@@ -53,21 +119,12 @@ export async function installer(version: string): Promise<void> {
   const archName: string = getArch(process.arch);
   core.debug(`Processor Architecture: ${archName}`);
 
-  const toolURL: string = getURL(osName, archName, extended, version);
-  core.debug(`toolURL: ${toolURL}`);
+  const toolURLs: string[] = getURL(osName, archName, extended, version);
 
   const workDir = await createWorkDir();
   const binDir = await createBinDir(workDir);
   const tempDir = await createTempDir(workDir);
 
-  const toolAssets: string = await tc.downloadTool(toolURL);
-  let toolBin = '';
-  if (process.platform === 'win32') {
-    const toolExtractedFolder: string = await tc.extractZip(toolAssets, tempDir);
-    toolBin = `${toolExtractedFolder}/${Tool.CmdName}.exe`;
-  } else {
-    const toolExtractedFolder: string = await tc.extractTar(toolAssets, tempDir);
-    toolBin = `${toolExtractedFolder}/${Tool.CmdName}`;
-  }
-  await io.mv(toolBin, binDir);
+  const toolAsset: DownloadedAsset = await downloadHugoAsset(toolURLs);
+  await extractHugoAsset(toolAsset.path, toolAsset.url, tempDir, binDir);
 }