External CMS

A site whose content is in a headless CMS, such as Sanity, Directus, Payload or Strapi, keeps that CMS. Its build fetches the content, and Hostsmith hosts the built files. The site adds the core, and declares the CMS in hostsmith.json:

"content": { "source": "external", "provider": "sanity" }

provider names the CMS for the people who read the file. An external site's content holds only these two keys. Kit sites always keep their content in the repository.

What the site gets

	Content in the repository	Content in an external CMS
Editing	Decap CMS or Sveltia CMS, or a commit	the CMS's own editor
`.hostsmith/schema.json` and the Decap config	yes	no: `npx site-kit schema` and `npx site-kit decap-config` write nothing and say why
`check-fields`	a gate with `--min`	a report only: the CMS's text has nothing in the repository to bind to
Deploys, previews, `check-urls`, updates, hosting	yes	yes
A content change reaches the site	with a commit	when the CMS starts the deploy workflow

The site still builds to static files, so it shows published content only: draft previews and visual editing need a server, and aren't supported. Keeping the site up covers its code and the core: dependency and core updates, the checks and hosting. The CMS's account, schema and content stay with the CMS.

Keep the token secret

The build reads the CMS with its read token. Keep the token in the deploy workflow's GitHub environment secrets, never in hostsmith.json or the repository.

Rebuild on publish

The deploy workflow also runs on demand, so the CMS can start a deploy when content is published. The CMS calls GitHub's API:

POST https://api.github.com/repos/OWNER/REPOSITORY/actions/workflows/hostsmith.yml/dispatches
Authorization: Bearer <token>
Accept: application/vnd.github+json

{"ref": "main", "inputs": {"target": "production"}}

The token is a fine-grained GitHub personal access token for that repository only, with the "Actions" repository permission at "Read and write". Keep it in the CMS's secret settings.

How each CMS sends the call:

Sanity: a GROQ-powered webhook, which fires when a change is published, not for drafts.
Directus: a Flow with an event hook trigger and a webhook operation.
Payload: an afterChange hook on each collection the site shows, since Payload has no webhook settings.
Strapi: a Document Service middleware, since Strapi's own webhooks send a fixed body that GitHub's API rejects.

The README has each setup in full, with the code for Payload and Strapi, and the rest of content in an external CMS.