ci: bump github/codeql-action/init from 4.36.2 to 4.37.9

Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.36.2 to 4.37.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...cdf488f595d80d6e07e03d4674febd5ab45fa938)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/codeql-analysis.yml

@@ -14,15 +14,15 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: javascript
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

.github/workflows/dependency-review.yml

@@ -13,5 +13,5 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.github/workflows/dev-image.yml

@@ -28,7 +28,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: make build
       - run: make cirun cmd="npm ci"
       # - run: make ciall

.github/workflows/label-commenter.yml

@@ -18,7 +18,7 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
 

.github/workflows/release.yml

@@ -12,7 +12,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Dump GitHub context
         env:

.github/workflows/test-action.yml

@@ -17,10 +17,10 @@ jobs:
         hugo-version: ['latest', '0.160.1']
         extended: [true, false]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Hugo
-        uses: peaceiris/actions-hugo@32c7754570a8edd0ae33352fae4a8448f23858e9 # v3.1.0
+        uses: peaceiris/actions-hugo@2752ce1d29631191ea3f27c23495fa06139a5b78 # v3.2.1
         with:
           hugo-version: ${{ matrix.hugo-version }}
           extended: ${{ matrix.extended }}

.github/workflows/test.yml

@@ -24,9 +24,9 @@ jobs:
           - 'macos-latest'
           - 'windows-latest'
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
@@ -53,4 +53,4 @@ jobs:
           name: coverage-${{ matrix.os }}
           path: coverage
 
-      - uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0

.github/workflows/update-major-tag.yml

@@ -11,7 +11,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Update major tag
         run: |

CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [3.2.1](https://github.com/peaceiris/actions-hugo/compare/v3.2.0...v3.2.1) (2026-05-10)
+
+
+### fix
+
+* handle Hugo 0.139.5 archive fallback (#696) ([4e5bf41](https://github.com/peaceiris/actions-hugo/commit/4e5bf412f00ba628ed366436825de7226933f80d)), closes [#696](https://github.com/peaceiris/actions-hugo/issues/696)
+
+
+
 # [3.2.0](https://github.com/peaceiris/actions-hugo/compare/v3.1.0...v3.2.0) (2026-05-10)
 
 

__tests__/get-url.test.ts

@@ -1,4 +1,4 @@
-import getURL from '../src/get-url';
+import getURL, {getDownloadVersion} from '../src/get-url';
 
 describe('getURL()', () => {
   test('get URLs to Linux assets', () => {
@@ -139,6 +139,19 @@ describe('getURL()', () => {
     ]);
   });
 
+  test('get URLs to Hugo 0.139.5 archive alias', () => {
+    const baseURL = 'https://github.com/gohugoio/hugo/releases/download/v0.139.4';
+    expect(getDownloadVersion('0.139.5')).toBe('0.139.4');
+    expect(getURL('linux', 'amd64', 'true', '0.139.5')).toEqual([
+      `${baseURL}/hugo_extended_0.139.4_linux-amd64.tar.gz`,
+      `${baseURL}/hugo_extended_0.139.4_Linux-amd64.tar.gz`,
+      `${baseURL}/hugo_extended_0.139.4_Linux_amd64.tar.gz`,
+      `${baseURL}/hugo_extended_v0.139.4_linux-amd64.tar.gz`,
+      `${baseURL}/hugo_extended_v0.139.4_Linux-amd64.tar.gz`,
+      `${baseURL}/hugo_extended_v0.139.4_Linux_amd64.tar.gz`
+    ]);
+  });
+
   test('get a fallback URL to an unknown OS asset', () => {
     const baseURL = 'https://github.com/gohugoio/hugo/releases/download/v0.58.2';
     expect(getURL('MyOS', '64bit', 'false', '0.58.2')).toEqual([

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "actions-hugo",
-  "version": "3.2.0",
+  "version": "3.2.1",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "actions-hugo",
-      "version": "3.2.0",
+      "version": "3.2.1",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "actions-hugo",
-  "version": "3.2.0",
+  "version": "3.2.1",
   "description": "GitHub Actions for Hugo",
   "main": "lib/index.js",
   "engines": {

src/get-url.ts

@@ -4,6 +4,8 @@ export default function getURL(
   extended: string,
   version: string
 ): string[] {
+  const downloadVersion = getDownloadVersion(version);
+
   const extendedStr = (extended: string): string => {
     if (extended === 'true') {
       return 'extended_';
@@ -28,12 +30,12 @@ export default function getURL(
   };
 
   const baseURL = 'https://github.com/gohugoio/hugo/releases/download';
-  const assetBase = `hugo_${extendedStr(extended)}${version}_`;
+  const assetBase = `hugo_${extendedStr(extended)}${downloadVersion}_`;
-  const legacyVersionedAssetBase = `hugo_${extendedStr(extended)}v${version}_`;
+  const legacyVersionedAssetBase = `hugo_${extendedStr(extended)}v${downloadVersion}_`;
   const assetBases = [assetBase, legacyVersionedAssetBase];
   const assetURLs = (assetNames: string[]): string[] => {
     return Array.from(new Set(assetNames)).map(assetName => {
-      return `${baseURL}/v${version}/${assetName}`;
+      return `${baseURL}/v${downloadVersion}/${assetName}`;
     });
   };
 
@@ -82,3 +84,12 @@ export default function getURL(
 
   return assetURLs([`${assetBase}${os}-${arch}.tar.gz`]);
 }
+
+export function getDownloadVersion(version: string): string {
+  if (version === '0.139.5') {
+    // v0.139.5 has no release archives; Hugo publishes the same archives under v0.139.4.
+    return '0.139.4';
+  }
+
+  return version;
+}

src/installer.ts

@@ -5,7 +5,7 @@ import * as exec from '@actions/exec';
 import {getConventions} from './get-conventions';
 import getOS from './get-os';
 import getArch from './get-arch';
-import getURL from './get-url';
+import getURL, {getDownloadVersion} from './get-url';
 import * as path from 'path';
 import {Tool, Action} from './constants';
 
@@ -123,6 +123,12 @@ export async function installer(version: string): Promise<void> {
   core.debug(`Processor Architecture: ${archName}`);
 
   const toolURLs: string[] = getURL(osName, archName, extended, version);
+  const downloadVersion = getDownloadVersion(version);
+  if (downloadVersion !== version) {
+    core.info(
+      `Hugo ${version} release does not publish archives; downloading v${downloadVersion} archives instead.`
+    );
+  }
 
   const workDir = await createWorkDir();
   const binDir = await createBinDir(workDir);