feat: upgrade Hugo to 0.164.0 and replace hardcoded copy with positioning data

.devcontainer/Dockerfile

@@ -4,13 +4,17 @@
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
     ca-certificates \
-    nodejs \
-    npm \
     wget && \
     update-ca-certificates && \
     rm -rf /var/lib/apt/lists/*
 
-ARG HUGO_VERSION="0.155.1"
+ARG NODE_MAJOR=22
+# hadolint ignore=DL3008,DL4006
+RUN wget -qO- "https://deb.nodesource.com/setup_${NODE_MAJOR}.x" | bash - && \
+    apt-get install -y --no-install-recommends nodejs && \
+    rm -rf /var/lib/apt/lists/*
+
+ARG HUGO_VERSION="0.164.0"
 RUN wget --quiet "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_Linux-64bit.tar.gz" && \
     tar xzf hugo_extended_${HUGO_VERSION}_Linux-64bit.tar.gz && \
     rm -r hugo_extended_${HUGO_VERSION}_Linux-64bit.tar.gz && \

.github/workflows/ci.yml

@@ -1,5 +1,5 @@
 ---
-name: CI
+name: Build
 
 on:
   pull_request:
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -23,21 +23,23 @@ jobs:
           go-version-file: go.mod
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
 
       - name: Setup Hugo
-        uses: peaceiris/actions-hugo@2752ce1d29631191ea3f27c23495fa06139a5b78
+        uses: peaceiris/actions-hugo@2752ce1d29631191ea3f27c23495fa06139a5b78 # v3.2.1
         with:
-          hugo-version: '0.155.1'
+          hugo-version: '0.164.0'
           extended: true
 
       - name: Install Node dependencies
-        run: npm ci
+        run: |
+          npm ci
+          echo "${{ github.workspace }}/node_modules/.bin" >> "$GITHUB_PATH"
 
-      - name: Run tests
-        run: go test -race ./cmd/sync-content/...
+      - name: Run checks
+        run: make check
 
       - name: Sync content
         run: go run ./cmd/sync-content --org complytime --config sync-config.yaml --lock .content-lock.json --write

.github/workflows/deploy-gh-pages.yml

@@ -19,7 +19,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -29,33 +29,23 @@ jobs:
           go-version-file: go.mod
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
 
       - name: Setup Hugo
-        uses: peaceiris/actions-hugo@2752ce1d29631191ea3f27c23495fa06139a5b78
+        uses: peaceiris/actions-hugo@2752ce1d29631191ea3f27c23495fa06139a5b78 # v3.2.1
         with:
-          hugo-version: '0.155.1'
+          hugo-version: '0.164.0'
           extended: true
 
       - name: Install dependencies
-        run: npm ci
-
-      - name: Go vet
-        run: go vet ./...
-
-      - name: Check formatting
         run: |
-          unformatted=$(gofmt -l ./cmd/sync-content/)
-          if [ -n "$unformatted" ]; then
-            echo "::error::Unformatted Go files:"
-            echo "$unformatted"
-            exit 1
-          fi
+          npm ci
+          echo "${{ github.workspace }}/node_modules/.bin" >> "$GITHUB_PATH"
 
-      - name: Run tests
-        run: go test -race ./cmd/sync-content/...
+      - name: Run checks
+        run: make check
 
       - name: Sync content
         run: go run ./cmd/sync-content --org complytime --config sync-config.yaml --lock .content-lock.json --write
@@ -66,7 +56,7 @@ jobs:
         run: hugo --minify --gc
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: ./public
 

.github/workflows/sync-content-check.yml

@@ -16,7 +16,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -61,7 +61,7 @@ jobs:
 
       - name: Create or update PR
         if: steps.check.outputs.has_changes == 'true'
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           add-paths: .content-lock.json
           branch: automated/content-sync-update

.gitignore

@@ -11,6 +11,7 @@ node_modules/
 # ─── Go ──────────────────────────────────────────────────────────────
 # Compiled sync engine binary (built by CI or locally).
 /sync-content
+cmd/sync-content/sync-content
 
 # ─── Synced content (generated by sync-content at build time) ────────
 # Per-repo project pages generated by the org scan and config overlay.

CONTRIBUTING.md

@@ -55,13 +55,17 @@ oriented quickly.
 
 ## Prerequisites
 
-| Tool       | Version   | Notes                                     |
-|------------|-----------|-------------------------------------------|
-| **Node.js** | ≥ 22      | Required by Hugo/Doks pipeline            |
-| **npm**    | (bundled) | Comes with Node.js                        |
-| **Hugo**   | ≥ 0.155.1 | Extended edition; installed via npm scripts |
-| **Go**     | ≥ 1.25    | Required for the content sync tool        |
-| **Git**    | Any recent | For cloning and version control            |
+| Tool       | Notes                                     |
+|------------|-------------------------------------------|
+| **Node.js** | Required by Hugo/Doks pipeline            |
+| **npm**    | Comes with Node.js                        |
+| **Hugo**   | Extended edition; installed via npm scripts |
+| **Go**     | Required for the content sync tool        |
+| **Git**    | For cloning and version control            |
+
+Exact version requirements are enforced at runtime by `make dev` (and every
+other Make target). If a tool is missing or too old, Make tells you what to
+install and which version is needed.
 
 > **Tip:** If you only want to edit Markdown content, Node.js + npm is all you
 > need. Go is only required if you need to run the sync tool or its tests.
@@ -135,13 +139,18 @@ website/
 │           └── {repo}/              #   Generated per-repo content (gitignored)
 │
 ├── data/
+│   ├── positioning.yaml             #   Hand-maintained positioning content (committed)
 │   └── projects.json                #   Generated landing page cards (gitignored)
 │
-├── layouts/                         # Custom Hugo layout overrides
+├── layouts/                         # Custom Hugo layout overrides (see table below)
+│   ├── baseof.html                  #   Base HTML shell override
 │   ├── home.html                    #   Homepage template (hero + features)
+│   ├── versions.html                #   Version-picker page
 │   ├── docs/list.html               #   Docs section listing template
-│   └── _default/_markup/
-│       └── render-image.html        #   Custom image render hook
+│   ├── shortcodes/                  #   Custom shortcodes
+│   ├── _partials/                   #   Partial overrides (SEO, header, head, footer)
+│   ├── _default/_markup/            #   Render hook overrides
+│   └── _markup/                     #   Additional render hooks
 │
 ├── sync-config.yaml                 #   Declarative file sync manifest
 ├── .content-lock.json               #   Approved upstream SHAs per repo (committed)
@@ -303,10 +312,22 @@ into the same relative path under `layouts/` and modify it.
 
 | File | What It Overrides | Why |
 |------|-------------------|-----|
-| `layouts/home.html` | Doks default homepage | Custom hero, features, and project cards |
-| `layouts/docs/list.html` | Doks docs list | Custom section listing layout |
-| `layouts/_default/_markup/render-image.html` | `@thulite/images` render hook | Fixes broken remote SVG/badge images |
-| `layouts/_partials/footer/script-footer-custom.html` | (empty hook) | Available for custom footer scripts |
+| `baseof.html` | Theme base HTML shell | Scroll-spy, configurable container breakpoint, to-top button |
+| `home.html` | Doks default homepage | Custom hero, features, and project cards |
+| `versions.html` | (custom layout) | Version-picker page from `docs-versions` data |
+| `docs/list.html` | Doks docs list | Custom section listing layout |
+| `shortcodes/positioning.html` | (custom shortcode) | Renders positioning data from `data/positioning.yaml` |
+| `shortcodes/project-cards.html` | (custom shortcode) | Language-badged project cards from `data/projects.json` |
+| `shortcodes/theme-image.html` | (custom shortcode) | Light/dark image swap via CSS class |
+| `_partials/seo/opengraph.html` | Theme OpenGraph partial | Full OpenGraph meta tags with article metadata |
+| `_partials/seo/favicons.html` | Theme favicon partial | Multi-size favicons and webmanifest from source PNG |
+| `_partials/header/header.html` | Theme header partial | ComplyTime logo and version dropdown |
+| `_partials/head/stylesheet.html` | Theme stylesheet partial | Dart Sass deprecation suppression |
+| `_partials/main/edit-page.html` | Theme edit-page partial | Per-page `editURL` front-matter support |
+| `_partials/footer/script-footer-custom.html` | (empty hook) | Available for custom footer scripts |
+| `_default/_markup/render-image.html` | `@thulite/images` render hook | Fixes broken remote SVG/badge images |
+| `_default/_markup/render-heading.html` | Theme heading render hook | Clickable `#` anchor links on headings |
+| `_markup/render-codeblock-kroki.html` | Theme Kroki code-block hook | Fixes upstream `output_format` casing and error severity |
 
 ### The Module Mount System