timothyswan/defectdojo-docs-builder repository overview

A build-time helper image: the rebased hugo-source⁠ static-site generator (Tier 1 Go from source, extended via CGO + bundled libsass) layered onto hi/nodejs:24.15-builder. It renders DefectDojo's self-hosted documentation tarball, which the host nginx serves at /docs/ (see docs/defectdojo-deploy-runbook.md Step 9.5). v1.58.8 switched from the Tier 2 hugo binary to hugo-source — supply-chain control over the Go stdlib version, eliminating the CVE-lag inherited from upstream-binary releases. See README.md for the full version history.

⁠Why combined

DefectDojo's upstream docs use the Doks theme (Thulite). The theme's CSS pipeline routes through Hugo's resources.PostProcess, which shells out to PostCSS via npx — so the Hugo binary needs node and npm on PATH at build time. A standalone Hugo image cannot run the build alone; this image carries both, with Hugo copied on top of the Node builder base.

⁠Usage

A deploy-time tool, not a runtime service. The operator mounts the DefectDojo docs source and runs the two-step build:

podman run --rm --user 0 -v "$DOCS_SRC:/src:Z" -w /src \
  <docs-builder-image> bash -c 'npm ci && hugo --minify --gc'

Output lands at $DOCS_SRC/public/. There is no ENTRYPOINT — the build command is passed directly.

⁠Supply chain

• Bases: hi/nodejs:24.15-builder (runtime) plus the rebased hugo-source image as a builder stage. Both are ARGs (HUGO_IMAGE / NODEJS_IMAGE), overridable for the air-gapped phases.
• Built by the build:docs-builder CI job.
• Signed: cosign key-only signature with the internal CI key (no Rekor transparency log).