Add Hugo site and Firebase Hosting (preview deploy)

.github/workflows/deploy.yml

@@ -0,0 +1,42 @@
+name: Deploy to Live Channel
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "content/mosaic/**"
+      - ".github/workflows/deploy.yml"
+      - "package.json"
+
+permissions:
+  contents: read
+  deployments: write
+  checks: write
+
+jobs:
+  deploy_live_website:
+    environment: production
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Hugo
+        uses: peaceiris/actions-hugo@v3
+        with:
+          hugo-version: "0.147.0"
+          extended: true
+      - name: Build
+        run: hugo --gc --minify
+        working-directory: content/mosaic
+      - name: Set hosting release retention
+        env:
+          FIREBASE_SERVICE_ACCOUNT: ${{ secrets.FIREBASE_SERVICE_ACCOUNT }}
+        run: node scripts/set-hosting-retention.js 5
+      - uses: FirebaseExtended/action-hosting-deploy@v0
+        with:
+          repoToken: "${{ secrets.GITHUB_TOKEN }}"
+          firebaseServiceAccount: "${{ secrets.FIREBASE_SERVICE_ACCOUNT }}"
+          projectId: mozaic-56ca8
+          target: mozaic-56ca8
+          channelId: live
+          entryPoint: content/mosaic

.github/workflows/pr_deploy.yml

@@ -0,0 +1,68 @@
+# Preview deploy for PRs. Fork PRs use the production environment so a
+# maintainer can approve before secrets are used (see Settings → Environments).
+
+name: Deploy to Preview Channel
+
+on:
+  pull_request:
+    paths:
+      - "content/mosaic/**"
+      - ".github/workflows/**"
+      - "package.json"
+
+permissions:
+  contents: read
+  pull-requests: write
+  deployments: write
+  checks: write
+
+jobs:
+  build_and_preview_same_repo:
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - name: Setup Hugo
+        uses: peaceiris/actions-hugo@v3
+        with:
+          hugo-version: "0.147.0"
+          extended: true
+      - name: Build
+        run: hugo --gc --minify
+        working-directory: content/mosaic
+      - uses: FirebaseExtended/action-hosting-deploy@v0
+        with:
+          repoToken: "${{ secrets.GITHUB_TOKEN }}"
+          firebaseServiceAccount: "${{ secrets.FIREBASE_SERVICE_ACCOUNT }}"
+          expires: 3d
+          projectId: mozaic-56ca8
+          target: mozaic-56ca8
+          entryPoint: content/mosaic
+
+  build_and_preview_fork:
+    if: github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - name: Setup Hugo
+        uses: peaceiris/actions-hugo@v3
+        with:
+          hugo-version: "0.147.0"
+          extended: true
+      - name: Build
+        run: hugo --gc --minify
+        working-directory: content/mosaic
+      - uses: FirebaseExtended/action-hosting-deploy@v0
+        with:
+          repoToken: "${{ secrets.GITHUB_TOKEN }}"
+          firebaseServiceAccount: "${{ secrets.FIREBASE_SERVICE_ACCOUNT }}"
+          expires: 3d
+          projectId: mozaic-56ca8
+          target: mozaic-56ca8
+          entryPoint: content/mosaic

.gitignore

@@ -0,0 +1,6 @@
+content/mosaic/public/
+content/mosaic/resources/
+content/mosaic/.hugo_build.lock
+content/mosaic/hugo_stats.json
+node_modules/
+firebase-service-account.json

CONTRIBUTING.md

@@ -1,7 +1,7 @@
 This repository contains files (under 'code'), issues and discussions. 
 
 # For whom?
-This platform is primarily for [MOSAIC participants](docs/participants.md), but as this is an open collaboration: MOSAIC welcomes input from others, as long as these are respectful and aiming to help.
+This platform is primarily for [MOSAIC participants](docs/memberorganizations.md), but as this is an open collaboration: MOSAIC welcomes input from others, as long as these are respectful and aiming to help.
 
 # How to use Discussions
 Use GitHub Discussions for suggestions, ideas and questions.
@@ -17,8 +17,54 @@ We generally do not use GitHub Issues.
 4. Agree to submit the pull request (the proposal of your change).
 5. An assigned code owner will review the change before it becomes part of the main branch.
 
-Note: you may get questions from Github during this process  -just agree to them. Explanation for your information:
+Note: you may get questions from Github during this process — just agree to them. Explanation for your information:
 - If you have a 'writer' role and you save your edit, GitHub asks "Create a new branch for this commit and start a pull request."
 - If you don't have a 'writer' role, you are asked to create a fork when you start editing: this is a copy of the repository in your own space, where you make the change, and then it becomes a proposal for the 'main' content.
 
 Note: the files are typically documents, as this is a collaboration platform on standards and guidelines.
+
+# Website
+
+The public site lives in [`content/mosaic/`](content/mosaic/). It is built with Hugo and deployed to Firebase Hosting via GitHub Actions.
+
+## Build locally
+
+```bash
+npm run build:site
+npm run serve
+```
+
+Open http://localhost:3000
+
+## Firebase Hosting release retention
+
+Hosting keeps previous releases for rollbacks. We cap retention at **5 releases per channel** (live and preview).
+
+Maintainers run [`scripts/set-hosting-retention.js`](scripts/set-hosting-retention.js) with the Firebase service account used for deploys. The script authenticates via one of:
+
+1. **`firebase-service-account.json`** at the repository root (recommended locally). Copy the JSON from the `FIREBASE_SERVICE_ACCOUNT` GitHub Actions secret into this file. The file is gitignored — never commit it.
+2. **`FIREBASE_SERVICE_ACCOUNT`** environment variable (JSON string; used in CI).
+3. **`GOOGLE_APPLICATION_CREDENTIALS`** environment variable (path to a service account JSON file).
+
+```bash
+# after placing firebase-service-account.json in the repo root:
+npm run hosting:retention
+
+# or with an explicit count (1–100):
+node scripts/set-hosting-retention.js 5
+```
+
+Optional environment variables: `FIREBASE_PROJECT` (default `mozaic-56ca8`), `FIREBASE_SITE` (default `mozaic-56ca8`).
+
+The live deploy workflow runs this automatically before each production deploy.
+
+## Analytics
+
+The site uses [GoatCounter](https://www.goatcounter.com/) for privacy-friendly, cookie-free page view statistics. The tracking snippet is in [`content/mosaic/layouts/_default/baseof.html`](content/mosaic/layouts/_default/baseof.html):
+
+```html
+<script data-goatcounter="https://mosaic.goatcounter.com/count"
+        async src="//gc.zgo.at/count.js"></script>
+```
+
+GoatCounter collects aggregate page views only (no personal data, no cookies). Do not add additional trackers without discussion.

README.md

@@ -11,9 +11,22 @@ See [roadmap](docs/roadmap.md).
 
 More information in this [linkedin post](https://www.linkedin.com/posts/robvanderveer_on-april-21-2026-a-major-breakthrough-in-share-7454830488919281664-0Kja) and in the [notes of the launching meeting](docs/meeting-notes/20260521-MOSAIC-launch.md).
 
+## Website
+
+The public site is a Hugo rebuild of the MOSAIC marketing site (same layout, CSS, and content as the original static HTML), deployed to Firebase Hosting from GitHub Actions.
+
+- Live: https://mozaic-56ca8.web.app (custom domain TBD)
+- Site source: [`content/mosaic/`](content/mosaic/) — pages, layouts, and `static/assets/`
+- Preview URLs are posted on pull requests (3-day expiry)
+- Maintainer scripts: see [CONTRIBUTING.md](CONTRIBUTING.md#website) (local build, Firebase release retention)
+
+### Analytics
+
+The site uses [GoatCounter](https://www.goatcounter.com/) for privacy-friendly, cookie-free page view statistics (`https://mosaic.goatcounter.com`). No personal data is collected. See [CONTRIBUTING.md](CONTRIBUTING.md#analytics) for details.
+
 ## How to use and contribute
 To participate: see the [contribution guide](CONTRIBUTING.md). Discussions can be found [here](https://github.com/OWASP/MOSAIC/discussions).   
-To read: see this README document and the [docs folder](/docs).
+To read: see this README, the [docs folder](/docs), or the website.
 
 Types of users:
 - member organizations: coordinate as agreed

content/mosaic/.firebaserc

@@ -0,0 +1,5 @@
+{
+  "projects": {
+    "default": "mozaic-56ca8"
+  }
+}