ci: harden GitHub Actions workflows

Pin workflow actions to commit SHAs, set explicit permissions and timeouts, update Ubuntu runners, and include the generated action bundle.

Co-Authored-By: Codex <noreply@openai.com>

.github/workflows/codeql-analysis.yml

@@ -6,19 +6,24 @@ on:
       - main
   pull_request:
 
+permissions:
+  security-events: write
+  contents: read
+
 jobs:
   CodeQL-Build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@1521896cd211af95be3f02edf6f436e10b819c27 # v3.35.4
         with:
           languages: javascript
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v2
+        uses: github/codeql-action/autobuild@1521896cd211af95be3f02edf6f436e10b819c27 # v3.35.4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@1521896cd211af95be3f02edf6f436e10b819c27 # v3.35.4

.github/workflows/dependency-review.yml

@@ -10,7 +10,8 @@ permissions:
 
 jobs:
   dependency-review:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-      - uses: actions/dependency-review-action@v2
+      - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0

.github/workflows/dev-image.yml

@@ -21,11 +21,15 @@ on:
       - 'Dockerfile'
       - 'Makefile'
 
+permissions:
+  contents: read
+
 jobs:
   dev-image-test:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - run: make build
       - run: make cirun cmd="npm ci"
       # - run: make ciall

.github/workflows/label-commenter.yml

@@ -10,16 +10,21 @@ on:
   #     - labeled
   #     - unlabeled
 
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   comment:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: main
 
       - name: Label Commenter
-        uses: peaceiris/actions-label-commenter@v1.10.0
+        uses: peaceiris/actions-label-commenter@c74c602750041f04c2bb68d200fc2fdae169a044 # v1.10.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           # config_file: .github/label-commenter-config.yml

.github/workflows/purge-readme-image-cache.yml

@@ -4,13 +4,16 @@ on:
   schedule:
     - cron: '4 18 * * */7'
 
+permissions: {}
+
 jobs:
   purge:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
     steps:
-
+      - name: Purge README image cache
-    - run: >
+        run: >
-        curl -sL https://github.com/${GITHUB_REPOSITORY} |
+          curl -sL "https://github.com/${GITHUB_REPOSITORY}" |
-        grep -oE '<img src="https?://camo.githubusercontent.com/[^"]+' |
+          grep -oE '<img src="https?://camo.githubusercontent.com/[^"]+' |
-        sed -e 's/<img src="//' |
+          sed -e 's/<img src="//' |
-        xargs -I % curl -sX PURGE %
+          xargs -I % curl -sX PURGE %

.github/workflows/release.yml

@@ -5,21 +5,15 @@ on:
     tags:
       - 'v*.*.*'
 
+permissions:
+  contents: write
+
 jobs:
   release:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-
-      - name: Dump GitHub context
-        env:
-          GITHUB_CONTEXT: ${{ toJson(github) }}
-        run: echo "${GITHUB_CONTEXT}"
-
-      - name: Install github/hub
-        run: |
-          export HUB_VERSION="2.14.2"
-          curl -fsSL https://github.com/github/hub/raw/8d91904208171b013f9a9d1175f4ab39068db047/script/get | bash -s "${HUB_VERSION}"
 
       - name: Create release
         env:
@@ -29,8 +23,8 @@ jobs:
           echo "See [CHANGELOG.md](https://github.com/${GITHUB_REPOSITORY}/blob/${TAG_NAME}/CHANGELOG.md) for more details." > ./release_notes.md
           RELEASE_NAME="$(jq -r '.name' ./package.json)"
           sed -i "1i${RELEASE_NAME} ${TAG_NAME}\n" ./release_notes.md
-          ./bin/hub release create \
+          gh release create "${TAG_NAME}" \
             --draft \
             --prerelease \
-            --file ./release_notes.md \
+            --notes-file ./release_notes.md \
-            "${TAG_NAME}"
+            --title "${RELEASE_NAME} ${TAG_NAME}"

.github/workflows/test-action.yml

@@ -1,39 +1,39 @@
-name: Daily Test
+name: Test Action
 
 on:
-  schedule:
+  push:
-    - cron: '13 13 * * *'
+    branches: [main, feat/node24]
+  pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test:
-    runs-on: ${{ matrix.os }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
     strategy:
       matrix:
-        os:
+        hugo-version: ['latest', '0.160.1']
-          - 'ubuntu-22.04'
+        extended: [true, false]
-          - 'ubuntu-20.04'
-          - 'ubuntu-latest'
-          - 'macos-latest'
-          - 'windows-latest'
-        hugo-version:
-          - 'latest'
-          - '0.61.0'
-        extended:
-          - true
-          - false
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - run: npm ci
+
+      - run: npm run build
 
       - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2.5.0
+        uses: ./
         with:
           hugo-version: ${{ matrix.hugo-version }}
           extended: ${{ matrix.extended }}
 
-      - name: Run hugo version
+      - name: Verify Hugo
-        run: echo "::set-output name=hugo_version::$(hugo version)"
+        run: hugo version
-        id: hugo_version
-
-      - name: '${{ steps.hugo_version.outputs.hugo_version }}'
-        run: echo '${{ steps.hugo_version.outputs.hugo_version }}'

.github/workflows/test.yml

@@ -10,49 +10,48 @@ on:
     paths-ignore:
       - '**.md'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
     strategy:
+      fail-fast: false
       matrix:
         os:
-          - 'ubuntu-22.04'
+          - 'ubuntu-24.04'
-          - 'ubuntu-20.04'
-          - 'ubuntu-latest'
           - 'macos-latest'
           - 'windows-latest'
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - name: Read .nvmrc
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        run: echo "::set-output name=NVMRC::$(cat .nvmrc)"
-        id: nvm
-
-      - name: Setup Node
-        uses: actions/setup-node@v3.5.1
         with:
-          node-version: '${{ steps.nvm.outputs.NVMRC }}'
+          node-version-file: '.nvmrc'
+          cache: 'npm'
 
       - run: npm ci
 
       - name: Run prettier
-        if: startsWith(matrix.os, 'ubuntu-22.04')
+        if: matrix.os == 'ubuntu-24.04'
         run: npm run format:check
 
       - name: Run eslint
-        if: startsWith(matrix.os, 'ubuntu-22.04')
+        if: matrix.os == 'ubuntu-24.04'
         run: npm run lint
 
       - name: Run ncc
-        if: startsWith(matrix.os, 'ubuntu-22.04')
+        if: matrix.os == 'ubuntu-24.04'
         run: npm run build
 
       - run: npm test
 
       - name: Upload test coverage as artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: coverage-${{ matrix.os }}
           path: coverage
 
-      - uses: codecov/codecov-action@v3
+      - uses: codecov/codecov-action@aa56896cf108bd10b5eb883cd1d24196da57f695 # v5.5.4

.github/workflows/update-major-tag.yml

@@ -4,17 +4,20 @@ on:
   release:
     types: [released]
 
+permissions:
+  contents: write
+
 jobs:
   update:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Update major tag
         run: |
           git config user.name "${GITHUB_ACTOR}"
           git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
-          git remote set-url origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${GITHUB_REPOSITORY}.git"
           export TAG_NAME="${GITHUB_REF##refs/tags/}"
           export TAG_MAJOR="${TAG_NAME%%.*}"
           git tag --force -a "${TAG_MAJOR}" -m "Release ${TAG_NAME}"

.nvmrc

@@ -1 +1 @@
-12.22.4
+20.11.1

AGENTS.md

@@ -0,0 +1,31 @@
+# Repository Guidelines
+
+## Project Structure & Module Organization
+
+This repository contains a TypeScript GitHub Action for installing Hugo. Runtime source lives in `src/`, with `src/index.ts` as the action entry and `src/main.ts` coordinating input handling and installation. Tests live in `__tests__/`, with fixtures in `__tests__/data/`. The action metadata is `action.yml`; it points to the bundled output `lib/index.js`, which is generated by `npm run build`. Workflow automation is under `.github/workflows/`, and project imagery is in `images/`.
+
+## Build, Test, and Development Commands
+
+- `npm ci`: install dependencies from `package-lock.json`.
+- `npm run all`: run format check, ESLint, and Jest tests; use this before opening a PR.
+- `npm test`: run Jest with coverage and verbose output.
+- `npm run lint` / `npm run lint:fix`: check or fix TypeScript lint issues.
+- `npm run format:check` / `npm run format`: check or apply Prettier formatting for `*.ts`.
+- `npm run build`: bundle `src/index.ts` into `lib/` with `ncc`.
+- `make build`, `make test`, `make all`: run the Docker-based development image and test flow.
+
+## Coding Style & Naming Conventions
+
+Use TypeScript with `strict` and `noImplicitAny` enabled. Follow the existing Prettier settings: 2-space indentation, single quotes, semicolons, 100-column print width, no trailing commas, and no bracket spacing. Use named exports for reusable helpers, keep filenames lowercase with hyphenated words such as `get-latest-version.ts`, and keep tests named `*.test.ts`. Makefiles use tabs, as defined in `.editorconfig`.
+
+## Testing Guidelines
+
+Jest with `ts-jest` and `jest-circus` runs all `**/*.test.ts` files in a Node environment. Add focused unit tests next to related behavior in `__tests__/`, and place mocked API responses or reusable input data in `__tests__/data/`. Preserve or improve coverage when changing installer logic, URL generation, OS/arch detection, or latest-version lookup.
+
+## Commit & Pull Request Guidelines
+
+Commit history follows short Conventional Commit-style prefixes such as `feat:`, `ci:`, and `docs:`. Keep commit subjects imperative and scoped to one change. PRs should describe the behavior change, mention linked issues when applicable, and list verification commands such as `npm run all` and `npm run build`. Include updates to `README.md`, `action.yml`, and tests whenever inputs, runtime behavior, or documented examples change.
+
+## Agent-Specific Instructions
+
+Use English for repository-facing content, including documentation, code comments, commit messages, and pull request text, unless the task explicitly requires another language.

CHANGELOG.md

@@ -2,6 +2,39 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+# [3.0.0](https://github.com/peaceiris/actions-hugo/compare/v2.6.0...v3.0.0) (2024-04-02)
+
+
+### build
+
+* node 20.11.1 ([01bd2b1](https://github.com/peaceiris/actions-hugo/commit/01bd2b16cc6cadbc63cba9bddb36c689f462c2db))
+
+### chore
+
+* npm audit fix ([966dfad](https://github.com/peaceiris/actions-hugo/commit/966dfad3859a5cfc80b6e36761b0b4c7b3dd5e0c))
+* revert version ([d85452e](https://github.com/peaceiris/actions-hugo/commit/d85452eadfba7065bf8c0601c8c22e427982d108))
+
+### ci
+
+* bump actions/dependency-review-action from 2 to 3 (#622) ([844f873](https://github.com/peaceiris/actions-hugo/commit/844f8735f61722d43677c23cbeae4283af7b554a)), closes [#622](https://github.com/peaceiris/actions-hugo/issues/622)
+* bump actions/setup-node from 3.5.1 to 3.6.0 (#625) ([3fa8fd6](https://github.com/peaceiris/actions-hugo/commit/3fa8fd6cee4e03774c4e900dca8b766d1cdcae93)), closes [#625](https://github.com/peaceiris/actions-hugo/issues/625)
+* bump checkout to v4 (#639) ([aadc3a9](https://github.com/peaceiris/actions-hugo/commit/aadc3a98dfd3437f8f97d436ea91b82a73dc85dd)), closes [#639](https://github.com/peaceiris/actions-hugo/issues/639)
+* bump peaceiris/actions-hugo from 2.5.0 to 2.6.0 (#621) ([b1822b6](https://github.com/peaceiris/actions-hugo/commit/b1822b6abe1a489f9ba7b9b664d916aeafd3e592)), closes [#621](https://github.com/peaceiris/actions-hugo/issues/621)
+
+### docs
+
+* bump ruby version to 3.2 (#629) ([7c4b9f1](https://github.com/peaceiris/actions-hugo/commit/7c4b9f1f99c72728600c292c1f0e7138cc3a8865)), closes [#629](https://github.com/peaceiris/actions-hugo/issues/629)
+* bump versions (#628) ([7652d53](https://github.com/peaceiris/actions-hugo/commit/7652d5336914f4ecd975baff70cd3c4b5070678b)), closes [#628](https://github.com/peaceiris/actions-hugo/issues/628)
+* remove braces (#634) ([31c4654](https://github.com/peaceiris/actions-hugo/commit/31c46541ceabb0656cd9e943914ab1701da3e788)), closes [#634](https://github.com/peaceiris/actions-hugo/issues/634)
+* replace set-output with GITHUB_OUTPUT ([3d92e2f](https://github.com/peaceiris/actions-hugo/commit/3d92e2fd556bef7470d7e2a6aea63141183c20a6))
+* update cache usage (#636) ([c0084b0](https://github.com/peaceiris/actions-hugo/commit/c0084b0763db3a37f864755d9174f2a6f3e0c1c5)), closes [#636](https://github.com/peaceiris/actions-hugo/issues/636)
+
+### feat
+
+* bump to use node20 runtime (#641) ([c57490a](https://github.com/peaceiris/actions-hugo/commit/c57490a8b04136ae58ab5866a93d3db2f0fa0945)), closes [#641](https://github.com/peaceiris/actions-hugo/issues/641)
+
+
+
 # [2.6.0](https://github.com/peaceiris/actions-hugo/compare/v2.5.0...v2.6.0) (2022-10-23)
 
 

README.md

@@ -2,6 +2,7 @@
 
 <img width="400" alt="GitHub Actions for Hugo" src="./images/ogp.svg">
 
+[![Project status: active – The project has reached a stable, usable state and is being actively developed.](https://www.repostatus.org/badges/latest/active.svg)](https://www.repostatus.org/#active)
 [![license](https://img.shields.io/github/license/peaceiris/actions-hugo.svg)](https://github.com/peaceiris/actions-hugo/blob/main/LICENSE)
 [![release](https://img.shields.io/github/release/peaceiris/actions-hugo.svg)](https://github.com/peaceiris/actions-hugo/releases/latest)
 [![GitHub release date](https://img.shields.io/github/release-date/peaceiris/actions-hugo.svg)](https://github.com/peaceiris/actions-hugo/releases)
@@ -84,15 +85,15 @@ jobs:
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           submodules: true  # Fetch Hugo themes (true OR recursive)
           fetch-depth: 0    # Fetch all history for .GitInfo and .Lastmod
 
       - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
+        uses: peaceiris/actions-hugo@v3
         with:
-          hugo-version: '0.91.2'
+          hugo-version: '0.119.0'
           # extended: true
 
       - name: Build
@@ -100,7 +101,7 @@ jobs:
 
       - name: Deploy
         uses: peaceiris/actions-gh-pages@v3
-        if: ${{ github.ref == 'refs/heads/main' }}
+        if: github.ref == 'refs/heads/main'
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./public
@@ -120,9 +121,9 @@ Set `extended: true` to use a Hugo extended version.
 
 ```yaml
 - name: Setup Hugo
-  uses: peaceiris/actions-hugo@v2
+  uses: peaceiris/actions-hugo@v3
   with:
-    hugo-version: '0.91.2'
+    hugo-version: '0.119.0'
     extended: true
 ```
 
@@ -132,7 +133,7 @@ Set `hugo-version: 'latest'` to use the latest version of Hugo.
 
 ```yaml
 - name: Setup Hugo
-  uses: peaceiris/actions-hugo@v2
+  uses: peaceiris/actions-hugo@v3
   with:
     hugo-version: 'latest'
 ```
@@ -150,12 +151,27 @@ This action fetches the latest version of Hugo by [hugo | Homebrew Formulae](htt
 ### ⭐️ Caching Hugo Modules
 
 Insert a cache step before site-building as follows.
-Note that the cache dir location of Hugo on a Linux-based operating system is `/tmp/hugo_cache`. On macOS, `${TMPDIR}/hugo_cache` has the location.
+
+First, to maximize compatibility with all Hugo versions, let's define the variable `HUGO_CACHEDIR`:
 
 ```yaml
-- uses: actions/cache@v2
+# * ...
+
+jobs:
+  deploy:
+    runs-on: ubuntu-22.04
+    env:
+      HUGO_CACHEDIR: /tmp/hugo_cache # <- Define the env variable here, so that Hugo's cache dir is now predictible in your workflow and doesn't depend on the Hugo's version you're using.
+
+# * ...
+```
+
+Now, let's add the cache action call just above the _Build_ step:
+
+```yaml
+- uses: actions/cache@v4
   with:
-    path: /tmp/hugo_cache
+    path: ${{ env.HUGO_CACHEDIR }} # <- Use the same env variable just right here
     key: ${{ runner.os }}-hugomod-${{ hashFiles('**/go.sum') }}
     restore-keys: |
       ${{ runner.os }}-hugomod-
@@ -175,7 +191,7 @@ How to sync a Hugo version between a Docker Compose and a GitHub Actions workflo
 Write a `HUGO_VERSION` to the `.env` file like the following and push it to a remote branch.
 
 ```sh
-HUGO_VERSION=0.91.2
+HUGO_VERSION=0.119.0
 ```
 
 Next, add a step to read a Hugo version from the `.env` file.
@@ -185,10 +201,10 @@ Next, add a step to read a Hugo version from the `.env` file.
       id: hugo-version
       run: |
         . ./.env
-        echo "::set-output name=HUGO_VERSION::${HUGO_VERSION}"
+        echo "HUGO_VERSION=${HUGO_VERSION}" >> "${GITHUB_OUTPUT}"
 
     - name: Setup Hugo
-      uses: peaceiris/actions-hugo@v2
+      uses: peaceiris/actions-hugo@v3
       with:
         hugo-version: '${{ steps.hugo-version.outputs.HUGO_VERSION }}'
         extended: true
@@ -249,21 +265,19 @@ jobs:
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@4
         with:
-          submodules: recursive  # Fetch the Docsy theme
           fetch-depth: 0         # Fetch all history for .GitInfo and .Lastmod
 
       - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
+        uses: peaceiris/actions-hugo@v3
         with:
-          hugo-version: '0.91.2'
+          hugo-version: '0.119.0'
           extended: true
 
-      - name: Setup Node
+      - uses: actions/setup-node@v4
-        uses: actions/setup-node@v3
         with:
-          node-version: '16'
+          node-version: '20'
           cache: 'npm'
           # The action defaults to search for the dependency file (package-lock.json,
           # npm-shrinkwrap.json or yarn.lock) in the repository root, and uses its
@@ -276,7 +290,7 @@ jobs:
 
       - name: Deploy
         uses: peaceiris/actions-gh-pages@v3
-        if: ${{ github.ref == 'refs/heads/master' }}
+        if: github.ref == 'refs/heads/master'
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
 ```
@@ -304,21 +318,21 @@ jobs:
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           submodules: true  # Fetch Hugo themes (true OR recursive)
           fetch-depth: 0    # Fetch all history for .GitInfo and .Lastmod
 
       - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
+        uses: peaceiris/actions-hugo@v3
         with:
-          hugo-version: '0.91.2'
+          hugo-version: '0.119.0'
           extended: true
 
       - name: Setup Ruby
         uses: ruby/setup-ruby@v1
         with:
-          ruby-version: 2.7
+          ruby-version: 3.2
 
       - run: gem install asciidoctor
 
@@ -329,7 +343,7 @@ jobs:
 
       - name: Deploy
         uses: peaceiris/actions-gh-pages@v3
-        if: ${{ github.ref == 'refs/heads/main' }}
+        if: github.ref == 'refs/heads/main'
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
 ```
@@ -356,7 +370,7 @@ jobs:
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
@@ -364,9 +378,9 @@ jobs:
         run: git config core.quotePath false
 
       - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
+        uses: peaceiris/actions-hugo@v3
         with:
-          hugo-version: '0.91.2'
+          hugo-version: '0.119.0'
 ```
 
 <div align="right">

action.yml

@@ -11,7 +11,7 @@ inputs:
     required: false
     default: 'false'
 runs:
-  using: 'node16'
+  using: 'node24'
   main: 'lib/index.js'
 branding:
   icon: 'package'

package.json

@@ -1,11 +1,11 @@
 {
   "name": "actions-hugo",
-  "version": "2.6.0",
+  "version": "3.0.0",
   "description": "GitHub Actions for Hugo",
   "main": "lib/index.js",
   "engines": {
-    "node": ">=16.18.0",
+    "node": ">=20.10.0",
-    "npm": ">=8.19.0"
+    "npm": ">=10.2.3"
   },
   "scripts": {
     "all": "npm run format:check && npm run lint && npm test",
@@ -55,11 +55,11 @@
   },
   "devDependencies": {
     "@types/jest": "^26.0.20",
-    "@types/node": "~12",
+    "@types/node": "~20",
     "@types/node-fetch": "^2.5.8",
     "@typescript-eslint/eslint-plugin": "^4.16.1",
     "@typescript-eslint/parser": "^4.16.1",
-    "@vercel/ncc": "^0.27.0",
+    "@vercel/ncc": "^0.38.1",
     "eslint": "^7.21.0",
     "eslint-plugin-jest": "^24.1.5",
     "husky": "^5.1.3",