@sebastienrousseau/dotfiles 0.2.468 → 0.2.481

package/install.sh

@@ -0,0 +1,255 @@
+#!/usr/bin/env bash
+# Universal Dotfiles Installer (Zero-Dependency)
+# Usage: sh -c "$(curl -fsSL https://dotfiles.io/install.sh)"
+# (or ./install.sh locally)
+#
+# This installer uses modular libraries from install/lib/:
+#   - os_detection.sh    : OS and architecture detection
+#   - package_managers.sh: Package manager bootstrapping
+#   - backup.sh          : Dotfile backup functionality
+#   - chezmoi.sh         : Chezmoi installation and configuration
+
+set -euo pipefail
+
+# =============================================================================
+# Configuration
+# =============================================================================
+
+VERSION="${1:-v0.2.480}"
+REPO_URL="https://github.com/sebastienrousseau/dotfiles.git"
+SOURCE_DIR="$HOME/.dotfiles"
+LEGACY_SOURCE_DIR="$HOME/.local/share/chezmoi"
+
+# =============================================================================
+# Colors and Output
+# =============================================================================
+
+if [[ -z "${NO_COLOR:-}" ]] && [[ -t 1 ]]; then
+  RED='\033[0;31m'
+  GREEN='\033[0;32m'
+  BLUE='\033[0;34m'
+  CYAN='\033[0;36m'
+  BOLD='\033[1m'
+  NC='\033[0m'
+else
+  RED='' GREEN='' BLUE='' CYAN='' BOLD='' NC=''
+fi
+
+step() { echo -e "${BLUE}==>${NC} ${BOLD}$1${NC}"; }
+success() { echo -e "${GREEN}==> Done!${NC}"; }
+error() {
+  echo -e "${RED}==> Error: $1${NC}"
+  exit 1
+}
+
+# =============================================================================
+# Banner
+# =============================================================================
+
+echo -e "${CYAN}${BOLD}"
+cat <<"EOF"
+   ___      _    _  _  _
+  / _ \___ | |_ (_)| |(_) ___  ___
+ / /_)/ _ \| __|| || || |/ _ \/ __|
+/ ___/ (_) | |_ | || || |  __/\__ \
+\/    \___/ \__||_||_||_|\___||___/
+           Universal Installer
+EOF
+echo -e "${NC}"
+
+# =============================================================================
+# Library Loading
+# =============================================================================
+
+# Determine script directory for library loading
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" 2>/dev/null && pwd)" || SCRIPT_DIR=""
+LIB_DIR="${SCRIPT_DIR}/install/lib"
+
+# Source libraries if available (for local installs)
+if [ -d "$LIB_DIR" ]; then
+  # shellcheck source=install/lib/os_detection.sh
+  source "$LIB_DIR/os_detection.sh"
+  # shellcheck source=install/lib/package_managers.sh
+  source "$LIB_DIR/package_managers.sh"
+  # shellcheck source=install/lib/backup.sh
+  source "$LIB_DIR/backup.sh"
+  # shellcheck source=install/lib/chezmoi.sh
+  source "$LIB_DIR/chezmoi.sh"
+  LIBS_LOADED=1
+else
+  LIBS_LOADED=0
+fi
+
+# =============================================================================
+# Inline Functions (for remote install without libraries)
+# =============================================================================
+
+if [ "$LIBS_LOADED" = "0" ]; then
+  # Minimal inline implementations when libraries aren't available
+  detect_os() {
+    OS="$(uname -s)"
+    ARCH="$(uname -m)"
+    target_os="unknown"
+    case "$OS" in
+      Darwin) target_os="macos" ;;
+      Linux)
+        if [ -f /proc/version ] && grep -qi 'microsoft\|WSL' /proc/version; then
+          target_os="wsl2"
+        elif [ -f /etc/os-release ]; then
+          . /etc/os-release
+          case "${ID:-}" in
+            ubuntu | debian | pop | linuxmint | elementary) target_os="debian" ;;
+            fedora | rhel | centos | rocky | alma) target_os="fedora" ;;
+            arch | manjaro | endeavouros) target_os="arch" ;;
+            *) target_os="linux" ;;
+          esac
+        else
+          target_os="linux"
+        fi
+        ;;
+    esac
+    export OS ARCH target_os
+  }
+
+  print_os_info() {
+    echo "   OS: $OS"
+    echo "   Arch: $ARCH"
+    echo "   Target: $target_os"
+  }
+
+  bootstrap_package_manager() {
+    if [ "$target_os" = "macos" ] && ! command -v brew >/dev/null; then
+      echo "   Homebrew not found."
+      echo -e "${CYAN}   SECURITY NOTE: This will download and execute code from brew.sh${NC}"
+      if [ "${DOTFILES_NONINTERACTIVE:-0}" != "1" ]; then
+        read -r -p "   Continue with Homebrew installation? [y/N] " response
+        case "$response" in
+          [yY][eE][sS] | [yY]) ;;
+          *) error "Homebrew installation cancelled." ;;
+        esac
+      fi
+      /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+      [ -x /opt/homebrew/bin/brew ] && eval "$(/opt/homebrew/bin/brew shellenv)"
+      [ -x /usr/local/bin/brew ] && eval "$(/usr/local/bin/brew shellenv)"
+    fi
+    case "$target_os" in
+      debian | wsl2) command -v apt-get >/dev/null || error "apt-get required" ;;
+      fedora) command -v dnf >/dev/null || error "dnf required" ;;
+      arch) command -v pacman >/dev/null || error "pacman required" ;;
+    esac
+  }
+
+  check_prerequisites() {
+    command -v curl >/dev/null || error "curl is required"
+    command -v git >/dev/null || error "git is required"
+  }
+
+  install_chezmoi() {
+    if command -v chezmoi >/dev/null; then
+      echo "   chezmoi already installed: $(chezmoi --version)"
+    elif command -v brew >/dev/null; then
+      brew install chezmoi
+    else
+      local bin_dir="$HOME/.local/bin"
+      mkdir -p "$bin_dir"
+      local installer
+      installer=$(mktemp)
+      curl -fsSL -o "$installer" https://get.chezmoi.io || error "Failed to download chezmoi"
+      [ "$(wc -c <"$installer")" -gt 102400 ] && {
+        rm -f "$installer"
+        error "Installer too large"
+      }
+      sh "$installer" -- -b "$bin_dir" 2>/dev/null || {
+        rm -f "$installer"
+        error "Failed to install chezmoi"
+      }
+      rm -f "$installer"
+      export PATH="$bin_dir:$PATH"
+    fi
+  }
+
+  ensure_chezmoi_source() {
+    local dir="$1"
+    local config_dir="$HOME/.config/chezmoi"
+    mkdir -p "$config_dir"
+    printf 'sourceDir = "%s"\n' "$dir" >"$config_dir/chezmoi.toml"
+  }
+
+  perform_backup() {
+    local backup_dir
+    backup_dir="$HOME/.dotfiles.bak.$(date +"%Y%m%d_%H%M%S")"
+    local count=0
+    if command -v chezmoi >/dev/null && [ -f "$HOME/.config/chezmoi/chezmoi.toml" ]; then
+      while IFS= read -r file; do
+        [ -z "$file" ] && continue
+        if [ -e "$file" ]; then
+          local rel="${file#"$HOME"/}"
+          mkdir -p "$backup_dir/$(dirname "$rel")"
+          cp -a "$file" "$backup_dir/$rel"
+          count=$((count + 1))
+        fi
+      done < <(chezmoi managed --path-style=absolute 2>/dev/null || true)
+    fi
+    [ "$count" -gt 0 ] && echo "   Backed up $count files to $backup_dir" || echo "   No files to back up."
+  }
+fi
+
+# =============================================================================
+# Main Installation Flow
+# =============================================================================
+
+# Step 1: Detect Environment
+step "Detecting Environment..."
+detect_os
+print_os_info
+
+# Step 2: Bootstrap Package Managers
+step "Checking Prerequisites..."
+bootstrap_package_manager
+check_prerequisites
+
+# Step 3: Install Chezmoi
+step "Installing Chezmoi..."
+install_chezmoi
+
+# Step 4: Backup Existing Dotfiles
+step "Backing up existing dotfiles..."
+if [ -d "$SOURCE_DIR/.git" ]; then
+  ensure_chezmoi_source "$SOURCE_DIR"
+elif [ -d "$LEGACY_SOURCE_DIR/.git" ]; then
+  ensure_chezmoi_source "$LEGACY_SOURCE_DIR"
+fi
+perform_backup
+
+# Step 5: Apply Configuration
+step "Applying Configuration..."
+
+APPLY_FLAGS=()
+[ "${DOTFILES_NONINTERACTIVE:-0}" = "1" ] && APPLY_FLAGS=(--force --no-tty)
+
+if [ -d "$SOURCE_DIR/.git" ]; then
+  echo "   Applying from local source: $SOURCE_DIR"
+  ensure_chezmoi_source "$SOURCE_DIR"
+  chezmoi apply "${APPLY_FLAGS[@]}"
+elif [ -d "$LEGACY_SOURCE_DIR/.git" ]; then
+  echo "   Migrating from legacy source: $LEGACY_SOURCE_DIR"
+  mv "$LEGACY_SOURCE_DIR" "$SOURCE_DIR"
+  ensure_chezmoi_source "$SOURCE_DIR"
+  chezmoi apply "${APPLY_FLAGS[@]}"
+else
+  echo "   Initializing from GitHub (Version: $VERSION)..."
+  echo -e "${CYAN}   SECURITY NOTE: Cloning pinned version $VERSION${NC}"
+
+  git clone --depth 1 --branch "$VERSION" "$REPO_URL" "$SOURCE_DIR" 2>/dev/null ||
+    { git clone "$REPO_URL" "$SOURCE_DIR" && (cd "$SOURCE_DIR" && git checkout "$VERSION"); }
+
+  ensure_chezmoi_source "$SOURCE_DIR"
+  chezmoi apply "${APPLY_FLAGS[@]}"
+fi
+
+# =============================================================================
+# Complete
+# =============================================================================
+
+success
+echo -e "${GREEN}Configuration loaded. Please restart your shell.${NC}"

package/package.json

@@ -1,90 +1,66 @@
 {
-  "assets": [
-    "./dist/bin/index.js"
-  ],
-  "author": "Sebastien Rousseau (https://github.com/sebastienrousseau)",
-  "autoupdate": {
-    "fileMap": [
-      {
-        "basePath": "dist",
-        "files": [
-          "**/*"
-        ]
-      }
-    ],
-    "source": "git",
-    "target": "git://github.com/sebastienrousseau/dotfiles.git"
-  },
+  "name": "@sebastienrousseau/dotfiles",
+  "version": "0.2.481",
+  "description": "The Trusted Shell Platform — Universal dotfiles managed by Chezmoi. Features Bash & Zsh for macOS, Linux & WSL. Rust modern tooling & enterprise-grade security.",
+  "main": "install.sh",
   "bin": {
-    "dotfiles": "./dist/bin/index.js"
-  },
-  "bugs": {
-    "url": "https://github.com/sebastienrousseau/dotfiles/issues"
-  },
-  "contributors": [
-    "Graham Colgate (https://github.com/gramtech)"
-  ],
-  "description": "Dotfiles - A set of macOS / Linux and Windows configuration files - Simply designed to fit your shell life.",
-  "devDependencies": {
-    "@types/node": "^18.19.17",
-    "compressing": "^1.10.0",
-    "filesizes": "^0.1.2",
-    "fs-extra": "11.1.1",
-    "husky": "^8.0.3",
-    "jsmin": "^1.0.1",
-    "rimraf": "^5.0.5",
-    "typescript": "^5.3.3",
-    "winston": "^3.11.0"
+    "dotfiles-install": "./install.sh"
   },
-  "directories": {
-    "bin": "./bin",
-    "lib": "./lib",
-    "scripts": "./scripts"
+  "scripts": {
+    "test": "bash -n install.sh && echo 'Syntax OK'",
+    "lint": "shellcheck install.sh scripts/**/*.sh"
   },
-  "engines": {
-    "node": "^12.20.0 || ^14.13.1 || >=20.0.0"
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/sebastienrousseau/dotfiles.git"
   },
-  "files": [
-    "dist/"
-  ],
-  "homepage": "https://dotfiles.io/",
   "keywords": [
     "dotfiles",
+    "shell",
+    "zsh",
     "bash",
-    "bash-profile",
+    "chezmoi",
     "macos",
-    "macosx",
-    "shell",
-    "homebrew",
-    "dotfiles-resources"
+    "linux",
+    "wsl",
+    "neovim",
+    "tmux",
+    "developer-tools",
+    "cli",
+    "automation",
+    "devops",
+    "security"
   ],
+  "author": {
+    "name": "Sebastien Rousseau",
+    "email": "sebastian.rousseau@gmail.com",
+    "url": "https://sebastienrousseau.com"
+  },
   "license": "MIT",
-  "license_URI": "http://www.opensource.org/licenses/mit-license.php",
-  "lockfileVersion": 1,
-  "main": "./dist/bin/index.js",
-  "name": "@sebastienrousseau/dotfiles",
+  "bugs": {
+    "url": "https://github.com/sebastienrousseau/dotfiles/issues"
+  },
+  "homepage": "https://dotfiles.io/",
+  "funding": {
+    "type": "github",
+    "url": "https://github.com/sponsors/sebastienrousseau"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
   "publishConfig": {
     "access": "public",
-    "registry": "https://npm.pkg.github.com/"
+    "registry": "https://registry.npmjs.org/"
   },
-  "repository": {
-    "type": "git",
-    "url": "git@github.com:sebastienrousseau/dotfiles.git"
-  },
-  "types": "./dist/bin/index.d.ts",
-  "version": "0.2.468",
-  "scripts": {
-    "build": "pnpm run backup && pnpm run copy && pnpm run assemble",
-    "backup": "chmod 755 \"./scripts/backup.sh\" && sh ./scripts/backup.sh backup",
-    "assemble": "pnpm run clean && npx tsc --build tsconfig.json && pnpm run compile",
-    "clean": "chmod 755 \"./scripts/clean.sh\" && sh ./scripts/clean.sh clean",
-    "compile": "chmod 755 \"./scripts/compile.sh\" && ./scripts/compile.sh compile",
-    "copy": "chmod 755 \"./scripts/copy.sh\" && ./scripts/copy.sh copy",
-    "help": "chmod 755 \"./scripts/help.sh\" && ./scripts/help.sh help",
-    "pack": "pnpm pack",
-    "preinstall": "npx only-allow pnpm",
-    "release": "pnpm run prepublishOnly && pnpm publish --access public --tag latest --no-git-checks --report-summary",
-    "start": "node ./dist/bin/index.js",
-    "test": "echo \"Error: no test specified\" && exit 1"
-  }
-}
+  "files": [
+    "install.sh",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md",
+    "docs/",
+    "dot_config/",
+    "dot_local/",
+    "scripts/",
+    "templates/"
+  ]
+}

package/scripts/ci/validate-ci-config.sh

@@ -0,0 +1,222 @@
+#!/usr/bin/env bash
+# CI Configuration Validation Script
+# Verifies that all zero-warning policy components are properly configured
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(dirname "$(dirname "$SCRIPT_DIR")")"
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[0;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo -e "${BLUE}      CI CONFIGURATION VALIDATOR      ${NC}"
+echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo ""
+
+ERRORS=0
+WARNINGS=0
+
+# Helper functions
+check_file_exists() {
+  local file="$1"
+  local description="$2"
+
+  if [[ -f "$file" ]]; then
+    echo -e "  ${GREEN}✓${NC} $description"
+    return 0
+  else
+    echo -e "  ${RED}✗${NC} $description"
+    ((ERRORS++))
+    return 1
+  fi
+}
+
+check_pattern_in_file() {
+  local file="$1"
+  local pattern="$2"
+  local description="$3"
+
+  if [[ -f "$file" ]] && grep -q "$pattern" "$file"; then
+    echo -e "  ${GREEN}✓${NC} $description"
+    return 0
+  else
+    echo -e "  ${RED}✗${NC} $description"
+    ((ERRORS++))
+    return 1
+  fi
+}
+
+warn_if_pattern() {
+  local file="$1"
+  local pattern="$2"
+  local description="$3"
+
+  if [[ -f "$file" ]] && grep -q "$pattern" "$file"; then
+    echo -e "  ${YELLOW}⚠${NC} $description"
+    ((WARNINGS++))
+    return 1
+  else
+    echo -e "  ${GREEN}✓${NC} $description"
+    return 0
+  fi
+}
+
+# Check 1: Core CI files exist
+echo -e "${BLUE}1. Core CI Files${NC}"
+check_file_exists "$REPO_ROOT/.github/workflows/ci.yml" "Main CI workflow exists"
+check_file_exists "$REPO_ROOT/.github/workflows/nightly.yml" "Nightly workflow exists"
+check_file_exists "$REPO_ROOT/.github/workflows/security-enhanced.yml" "Security workflow exists"
+check_file_exists "$REPO_ROOT/config/pre-commit-config.yaml" "Pre-commit configuration exists"
+echo ""
+
+# Check 2: Zero-warning enforcement
+echo -e "${BLUE}2. Zero-Warning Policy Enforcement${NC}"
+check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "zero-warning" "Zero-warning policy documented"
+check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "fail on unformatted code" "Formatter failure enforced"
+check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "warnings-as-errors" "Warnings treated as errors"
+
+# Verify no || true patterns in security steps
+warn_if_pattern "$REPO_ROOT/.github/workflows/ci.yml" "gitleaks.*||.*true" "Gitleaks bypass detected"
+warn_if_pattern "$REPO_ROOT/.github/workflows/ci.yml" "shellcheck.*||.*true" "Shellcheck bypass detected"
+echo ""
+
+# Check 3: Test coverage requirements
+echo -e "${BLUE}3. Test Coverage Requirements${NC}"
+check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "100%" "100% coverage requirement"
+check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "fail-under" "Coverage threshold enforcement"
+
+if [[ -f "$REPO_ROOT/scripts/tests/framework/test_runner.sh" ]]; then
+  echo -e "  ${GREEN}✓${NC} Test framework exists"
+else
+  echo -e "  ${RED}✗${NC} Test framework missing"
+  ((ERRORS++))
+fi
+echo ""
+
+# Check 4: Security scanning
+echo -e "${BLUE}4. Security Scanning Configuration${NC}"
+check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "security-secrets" "Secret scanning enabled"
+check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "security-dependencies" "Dependency audit enabled"
+check_pattern_in_file "$REPO_ROOT/config/pre-commit-config.yaml" "gitleaks" "Pre-commit secret scanning"
+check_pattern_in_file "$REPO_ROOT/config/pre-commit-config.yaml" "detect-secrets" "Advanced secret detection"
+
+# Verify no piped execution patterns
+warn_if_pattern "$REPO_ROOT/.github/workflows/ci.yml" "curl.*|.*sh" "Dangerous piped execution"
+warn_if_pattern "$REPO_ROOT/.github/workflows/ci.yml" "wget.*|.*bash" "Dangerous piped execution"
+echo ""
+
+# Check 5: Performance monitoring
+echo -e "${BLUE}5. Performance Monitoring${NC}"
+check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "benchmark" "Performance benchmarking enabled"
+check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "500ms" "Shell startup threshold defined"
+check_pattern_in_file "$REPO_ROOT/.github/workflows/nightly.yml" "performance-tracking" "Nightly performance tracking"
+echo ""
+
+# Check 6: Multi-OS support
+echo -e "${BLUE}6. Multi-OS Testing${NC}"
+check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "ubuntu-latest" "Linux testing enabled"
+check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "macos-latest" "macOS testing enabled"
+check_pattern_in_file "$REPO_ROOT/.github/workflows/nightly.yml" "matrix:" "OS matrix testing configured"
+echo ""
+
+# Check 7: Timeouts and efficiency
+echo -e "${BLUE}7. Timeout and Efficiency Settings${NC}"
+if grep -q "timeout-minutes: [0-9]" "$REPO_ROOT/.github/workflows/ci.yml"; then
+  MAX_TIMEOUT=$(grep "timeout-minutes:" "$REPO_ROOT/.github/workflows/ci.yml" |
+    awk '{print $2}' | sort -n | tail -1)
+  if [[ $MAX_TIMEOUT -le 15 ]]; then
+    echo -e "  ${GREEN}✓${NC} Job timeouts properly configured (max: ${MAX_TIMEOUT}min)"
+  else
+    echo -e "  ${YELLOW}⚠${NC} Some jobs have long timeouts (max: ${MAX_TIMEOUT}min)"
+    ((WARNINGS++))
+  fi
+else
+  echo -e "  ${RED}✗${NC} No timeout configuration found"
+  ((ERRORS++))
+fi
+
+check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "cache" "Dependency caching enabled"
+echo ""
+
+# Check 8: Branch protection readiness
+echo -e "${BLUE}8. Branch Protection Readiness${NC}"
+check_file_exists "$REPO_ROOT/.github/BRANCH_PROTECTION.md" "Branch protection documentation"
+check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "quality-gate" "Quality gate job defined"
+
+# Check for required status check names
+REQUIRED_CHECKS=(
+  "lint-shell"
+  "security-secrets"
+  "security-dependencies"
+  "test-unit"
+  "quality-gate"
+)
+
+for check in "${REQUIRED_CHECKS[@]}"; do
+  if grep -q "name:.*$check" "$REPO_ROOT/.github/workflows/ci.yml"; then
+    echo -e "  ${GREEN}✓${NC} Required check '$check' defined"
+  else
+    echo -e "  ${RED}✗${NC} Required check '$check' missing"
+    ((ERRORS++))
+  fi
+done
+echo ""
+
+# Check 9: Nightly extended testing
+echo -e "${BLUE}9. Nightly Extended Testing${NC}"
+if [[ -f "$REPO_ROOT/.github/workflows/nightly.yml" ]]; then
+  check_pattern_in_file "$REPO_ROOT/.github/workflows/nightly.yml" "dependency-updates" "Dependency monitoring"
+  check_pattern_in_file "$REPO_ROOT/.github/workflows/nightly.yml" "beta-tools-test" "Beta tool testing"
+  check_pattern_in_file "$REPO_ROOT/.github/workflows/nightly.yml" "security-extended" "Extended security scanning"
+  check_pattern_in_file "$REPO_ROOT/.github/workflows/nightly.yml" "cron:" "Scheduled execution"
+else
+  echo -e "  ${RED}✗${NC} Nightly workflow missing"
+  ((ERRORS++))
+fi
+echo ""
+
+# Final summary
+echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo -e "${BLUE}           VALIDATION SUMMARY         ${NC}"
+echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+
+if [[ $ERRORS -eq 0 ]] && [[ $WARNINGS -eq 0 ]]; then
+  echo -e "${GREEN}✅ PERFECT: CI configuration fully compliant${NC}"
+  echo "   - Zero-warning policy properly enforced"
+  echo "   - All security gates configured"
+  echo "   - Performance monitoring active"
+  echo "   - Ready for branch protection"
+elif [[ $ERRORS -eq 0 ]]; then
+  echo -e "${YELLOW}⚠️  GOOD: CI mostly compliant with $WARNINGS warning(s)${NC}"
+  echo "   - Core functionality working"
+  echo "   - Minor improvements recommended"
+else
+  echo -e "${RED}❌ ISSUES: CI configuration has $ERRORS error(s) and $WARNINGS warning(s)${NC}"
+  echo "   - Critical fixes required before deployment"
+fi
+
+echo ""
+echo "Configuration Details:"
+echo "  - Repository: $REPO_ROOT"
+echo "  - Main CI: .github/workflows/ci.yml"
+echo "  - Nightly: .github/workflows/nightly.yml"
+echo "  - Pre-commit: config/pre-commit-config.yaml"
+echo ""
+echo "Next Steps:"
+if [[ $ERRORS -gt 0 ]]; then
+  echo "  1. Fix critical errors listed above"
+  echo "  2. Re-run validation: $0"
+fi
+if [[ $WARNINGS -gt 0 ]]; then
+  echo "  3. Address warnings for optimal configuration"
+fi
+echo "  4. Configure branch protection rules per BRANCH_PROTECTION.md"
+echo "  5. Test CI pipeline with a small PR"
+
+exit $ERRORS

package/scripts/demo/record.sh

@@ -0,0 +1,41 @@
+#!/bin/sh
+set -e
+
+OUT="${1:-$HOME/.dotfiles/docs/demo/demo.gif}"
+DURATION="${DURATION:-30}"
+FPS="${FPS:-15}"
+
+record_ffmpeg() {
+  if command -v ffmpeg >/dev/null; then
+    echo "Recording with ffmpeg for ${DURATION}s..."
+    if [ "$(uname -s)" = "Darwin" ]; then
+      # macOS (AVFoundation)
+      ffmpeg -y -t "$DURATION" -f avfoundation -i "1:none" -vf "fps=$FPS,scale=1024:-1:flags=lanczos" "$OUT"
+    else
+      # Linux (X11)
+      ffmpeg -y -t "$DURATION" -f x11grab -i :0.0 -vf "fps=$FPS,scale=1024:-1:flags=lanczos" "$OUT"
+    fi
+  else
+    echo "ffmpeg not found. Install it and retry."
+    exit 1
+  fi
+}
+
+record_wf_recorder() {
+  if command -v wf-recorder >/dev/null; then
+    echo "Recording with wf-recorder for ${DURATION}s..."
+    wf-recorder -f "$OUT" -t "$DURATION"
+  else
+    return 1
+  fi
+}
+
+if [ "$(uname -s)" = "Linux" ]; then
+  if record_wf_recorder; then
+    exit 0
+  fi
+fi
+
+record_ffmpeg
+
+printf "Saved demo to %s\n" "$OUT"