@sebastienrousseau/dotfiles 0.2.499 → 0.2.500

package/templates/projects/node/package-lock.json

@@ -0,0 +1,12 @@
+{
+  "name": "__PROJECT_NAME__",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "__PROJECT_NAME__",
+      "version": "0.1.0"
+    }
+  }
+}

package/templates/projects/node/src/index.js

@@ -1,2 +1,3 @@
+// Copyright (c) 2015-2026 Dotfiles. All rights reserved.
 // eslint-disable-next-line no-console
 console.log("__PROJECT_NAME__");

package/templates/projects/packer/README.md

@@ -0,0 +1,15 @@
+# __PROJECT_NAME__
+
+Packer template scaffold.
+
+## Build
+
+```bash
+packer init .
+packer validate .
+packer build .
+```
+
+---
+
+Made with ❤️ by [Sebastien Rousseau](https://sebastienrousseau.com)

package/templates/projects/packer/main.pkr.hcl

@@ -0,0 +1,15 @@
+packer {
+  required_version = ">= 1.9.0"
+}
+
+source "null" "example" {
+  communicator = "none"
+}
+
+build {
+  sources = ["source.null.example"]
+
+  provisioner "shell" {
+    inline = ["echo 'Packer template: __PROJECT_NAME__'"]
+  }
+}

package/templates/projects/python/.github/workflows/ci.yml

@@ -0,0 +1,34 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]" || pip install -e .
+      - name: Run tests
+        run: python -m pytest tests/ -v || echo "No tests"
+
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - name: Security scan
+        run: |
+          pip install pip-audit
+          pip-audit --strict || echo "No vulnerabilities"

package/templates/projects/python/README.md

@@ -1,3 +1,7 @@
 # __PROJECT_NAME__
 
 Minimal Python project scaffold.
+
+---
+
+Made with ❤️ by [Sebastien Rousseau](https://sebastienrousseau.com)

package/templates/projects/python/pyproject.toml

@@ -8,3 +8,18 @@ dependencies = []
 [build-system]
 requires = ["hatchling"]
 build-backend = "hatchling.build"
+
+[tool.ruff]
+line-length = 88
+target-version = "py310"
+select = ["E", "F", "I", "UP", "B"]
+ignore = ["E203", "E501"]
+
+[tool.black]
+line-length = 88
+target-version = ["py310"]
+
+[tool.pyright]
+typeCheckingMode = "standard"
+pythonVersion = "3.10"
+reportMissingTypeStubs = "none"

package/templates/projects/python/src/__PROJECT_NAME__/__init__.py

@@ -1 +1,2 @@
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
 """__PROJECT_NAME__ package."""

package/templates/projects/python/tests/test_basic.py

@@ -1,2 +1,3 @@
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
 def test_smoke():
     assert True

package/docs/ARCHITECTURE.md

@@ -1,62 +0,0 @@
-# Architecture & Design
-
-v0.2.471 constitutes a portable **Shell Distribution** managed by `chezmoi`. This document outlines the core architectural decisions and system design.
-
-## 1. Core Philosophy
-
-- **XDG-First**: configuration is strictly mapped to `~/.config/` (XDG Base Directory specification). We avoid `~/.foo` file sprawl in the home directory.
-- **Single Entrypoint**: `dot_zshenv` acts as the "Bootloader". It is loaded by Zsh immediately and sets up the environment (XDG variables, PATH) before any other initialization occurs.
-- **Zero-Dependency Bootstrap**: The installation process relies only on `curl` and `git` (and `chezmoi`, which it self-installs).
-
-## 2. Directory Structure
-
-The repository follows standard `chezmoi` conventions:
-
-```text
-~/.local/share/chezmoi/
-├── dot_config/          # Mapped to ~/.config/
-│   ├── atuin/           # Shell history
-│   ├── ghostty/         # Terminal emulator
-│   ├── shell/           # Core shell logic (aliases, functions)
-│   ├── nvim/            # Neovim IDE configuration
-│   └── zsh/             # Zsh specific config
-├── dot_local/           # Mapped to ~/.local/
-│   └── bin/             # User scripts (added to PATH)
-├── dot_zshenv           # The Environment Bootloader
-├── .chezmoitemplates/   # Reusable logic blocks
-└── install.sh           # Universal bootstrapping script
-```
-
-## 3. Modern Toolchain
-
-We replace distinct Unix legacy tools with high-performance Rust alternatives:
-
-| Legacy | Modern Replacement | Purpose |
-| :--- | :--- | :--- |
-| `ls` | `eza` | Modern file listing with git integration |
-| `cat` | `bat` | Syntax highlighted file viewing |
-| `grep` | `ripgrep` (`rg`) | Blazing fast search |
-| `cd` | `zoxide` | Smart directory jumping |
-| `history` | `atuin` | Syncable, encrypted SQLite history |
-| `find` | `fd` | User-friendly filesystem search |
-| `vim` | `neovim` | Lua-extensible IDE |
-
-## 4. Predictive Shell Strategy
-
-- **AI Integration**: The shell is "AI Aware" via the `ai_core` wrapper.
-- **Autosuggestions**: Context-aware completion based on shell history.
-- **Error Analysis**: Hooks to send failed command context to local LLMs or GitHub Copilot for explanation.
-
-## 5. Security Posture
-
-- **Hardened Defaults**: Shell scripts run with `set -euo pipefail` to fail fast.
-- **Supply Chain Safety**:
-  - **Pinned Installation**: Installers reference specific Git tags (e.g., `v0.2.471`), not `main`.
-  - **Immutable History**: Logic logic is version controlled and reviewable via `chezmoi diff`.
-- **Audit Logging**: All mutations are logged to `~/.dotfiles_audit.log`.
-
-## 6. Compatibility
-
-- **macOS**: Full support (Homebrew, defaults).
-- **Linux**: Debian/Ubuntu support (apt-get).
-- **Windows**: WSL2 support.

package/docs/COMPLIANCE.md

@@ -1,47 +0,0 @@
-# Regulatory Compliance & Security Controls
-
-This document maps the dotfiles configuration and tooling to standard regulatory frameworks (SOC 2, ISO 27001, GDPR).
-
-## 🛡️ Control Mappings
-
-### SOC 2 Type II
-
-| Control | Description | Dotfiles Implementation |
-| :--- | :--- | :--- |
-| **CC6.1** | Logical Access Security | `zsh` restricted permissions, SSH key management via `1Password`/Agents. |
-| **CC6.8** | Unauthorized Code Protection | `enable-signing` enforces GPG/SSH signed commits. `slsa-framework` workflow. |
-| **CC8.1** | Change Management | All changes managed via git (Infrastructure as Code). `lock-configs` for immutability. |
-| **A1.2** | Audit Logs | `dotfiles_audit.log` tracks all configuration applications (`chezmoi apply`). |
-
-### ISO 27001
-
-| Control | Description | Dotfiles Implementation |
-| :--- | :--- | :--- |
-| **A.9.1.1** | Access Control Policy | Principle of Least Privilege in filesystem permissions (umask 022/077). |
-| **A.12.1.2** | Change Management | Git-based version control with CI/CD verification (`ci.yml`, `security-release.yml`). |
-| **A.14.2.5** | Secure Engineering | `scan-licenses` (FOSSology) and `check-cla` ensure legal/security compliance. |
-
-### GDPR / HIPAA (Privacy)
-
-| Requirement | Description | Dotfiles Implementation |
-| :--- | :--- | :--- |
-| **Data Minimization** | Limit data collection | `privacy-mode` disables CLI telemetry (Dotnet, Brew, Functions). |
-| **Integrity** | Protect against tampering | `lock-configs` prevents unauthorized modification of shell history/config. |
-
-## 🔒 Security Features
-
-### Immutability
-Critical configuration files can be locked to prevent tampering:
-```bash
-lock-configs  # Sets chflags uchg (macOS) or chattr +i (Linux)
-```
-
-### Forensic Audit
-All `chezmoi` operations are logged. View audit trails:
-```bash
-dot audit
-```
-
-### Supply Chain Security
-- **SBOM**: Generated for every release (SPDX format).
-- **Provenance**: SLSA Level 3 build attestation.

package/docs/OPERATIONS.md

@@ -1,103 +0,0 @@
-# Operational Guide
-
-This document outlines the standard workflows to **Maintain**, **Update**, and **Operate** your dotfiles environment across all supported platforms.
-
----
-
-## 🏗️ Platform-Specific Operations
-
-### 🍎 macOS
-**Primary Manager**: `Homebrew`
-
-- **Update System**:
-  ```bash
-  # Updates Dotfiles AND Homebrew packages
-  chezmoi update
-  ```
-  *Behind the scenes, this runs `brew bundle install` to match the `Brewfile.lock.json`.*
-
-- **Troubleshooting**:
-  - **Permission Issues**: `sudo chown -R $(whoami) $(brew --prefix)/*`
-  - **Drift**: Run `brew bundle cleanup` to remove unmanaged packages.
-
-### 🐧 Linux (Debian, Ubuntu, ZorinOS, Kali)
-**Primary Manager**: `apt-get` / `snap`
-
-- **Update System**:
-  ```bash
-  # 1. Update OS packages
-  sudo apt update && sudo apt upgrade -y
-  
-  # 2. Update Dotfiles
-  chezmoi update
-  ```
-  *Note: `chezmoi` on Linux focuses on configuration. Package updates are often best handled by the OS package manager to avoid `sudo` conflicts.*
-
-- **Troubleshooting**:
-  - **Font Issues**: If icons are missing, run `./provision/run_onchange_50-install-fonts.sh` manually.
-  - **ZorinOS/Gnome**: Custom keybindings may need `dconf load` if not applied automatically.
-
-### 🪟 Windows (WSL2)
-**Primary Manager**: `apt-get` (inside WSL)
-
-- **Update System**: Same as **Linux**.
-
-- **WSL Specifics**:
-  - **Access Windows Files**: Windows drives are mounted at `/mnt/c/`.
-  - **Clipboard**: The setup configures `win32yank.exe` automatically for clipboard sharing.
-  - **Performance**: We recommend keeping project files inside the Linux filesystem (`~/projects`), NOT in `/mnt/c/`, for 100x better IO performance.
-
----
-
-## 🔄 Common Workflows
-
-### Applying Changes
-After editing any config file:
-```bash
-chezmoi apply
-```
-*Triggers: `dot_zshrc` reload, audit logging.*
-
-### Rolling Back
-If an update breaks your setup:
-```bash
-cd ~/.local/share/chezmoi
-git reset --hard HEAD@{1}  # Go back 1 operation
-chezmoi apply
-```
-
-### Debugging
-If something feels slow or broken:
-
-1. **Check Health**:
-   ```bash
-   dot doctor
-   ```
-2. **Verbose Mode**:
-   ```bash
-   DOTFILES_DEBUG=1 chezmoi apply
-   ```
-
----
-
-## 🛠️ Tool-Specific Guides
-
-### 📦 Atuin (History Sync)
-- **Login**: `atuin login`
-- **Sync**: `atuin sync`
-- **Search**: `Ctrl-r` (Global history search)
-
-### 🚀 Zoxide (Smart CD)
-- **Jump**: `z project` matches `~/dev/project`
-- **Query**: `zi` (Interactive selection)
-
-### 🌳 Yazi (File Manager)
-- **Open**: Type `y`
-- **Preview**: Spacebar to preview files
-- **Quit**: `q`
-
----
-
-## 🔐 Security Policy
-- **GPG/SSH**: All commits are SSH signed.
-- **Audit Log**: Review `~/.dotfiles_audit.log` for a timeline of all changes applied to your system.

package/docs/PR_DESCRIPTION.md

@@ -1,150 +0,0 @@
-# PR Title
-feat(core): Rel v0.2.471 - Universal Config, Security & Performance
-
-# PR Description
-
-## 🚀 v0.2.471 Release: Universal Configuration
-
-This release transforms the dotfiles into a high-performance, universally compatible system managed by **chezmoi**.
-
-### 🏗️ Technical Architecture
-v0.2.471 is not just "dotfiles" but a portable **Shell Distribution** managed by `chezmoi` ("source of truth" in `~/.local/share/chezmoi`).
-
-- **XDG-First**: Configs strictly mapped to `~/.config/` (No `~/.foo` sprawl).
-- **Single Entrypoint**: `dot_zshenv` acts as an XDG bootloader for instant environment setup.
-- **Modern Toolchain**: Replaces classic Unix tools with high-performance Rust alternatives:
-  - `ls` → `eza`
-  - `cat` → `bat`
-  - `grep` → `ripgrep`
-  - `cd` → `zoxide` (Smart Directory Jumping)
-  - `history` → `atuin` (Syncable, Encrypted SQlite history)
-- **Predictive Shell**:
-  - **AI Strategy**: Context-aware autosuggestions coupled with optional local LLM integration (`ai_core`).
-  - **Error Analysis**: Smart wrappers to analyze command failures via `gh copilot` or local models.
-
-### 🚫 Non-Goals
-- **Not a Framework**: This is a curated distribution, not a plugin manager like Oh-My-Zsh.
-- **Not POSIX-Pure**: Prioritizes modern Zsh/Rust features over strict POSIX compliance.
-- **Not Minimal**: Optimizes for functionality and speed, not line-count minimalism.
-
-### 🛡️ Security Posture
-- **Hardened by Default**: Scripts run with `set -euo pipefail` to fail fast on errors.
-- **Supply Chain Safety**:
-  - **Pinned Install**: Installation commands are pinned to the specific release tag (`v0.2.471`) to prevent drift.
-  - **Zero-Trust**: No implicit reliance on `main` branch code in production.
-- **Threat Model**: This project assumes a **trusted local machine** and focuses on supply-chain (pinned versions) and configuration safety (immutable history).
-- **Audit Logging**: All `chezmoi` mutations are logged to `~/.dotfiles_audit.log` for day-2 operations review.
-
-### 🛠️ Changes
-- **Migrated**:
-  - Shell: `~/.zshrc` now sources generated templates from `~/.config/shell`.
-  - Shell: `~/.zshrc` now sources generated templates from `~/.config/shell`.
-  - Neovim: `~/.config/nvim` fully managed via Lua/Lazy.nvim.
-  - Tmux: Modular config consolidated to `~/.local/share/chezmoi/dot_tmux.conf`.
-- **Packaging**:
-  - `Brewfile` (macOS) and `apt-get` (Linux) handled automatically.
-- **Structural**:
-  - **Renamed**: `dot_config/dotfiles` → `dot_config/shell` for semantic clarity.
-  - **Moved**: `bin/` → `dot_local/bin/` for automatic path integration.
-  - **Segregated**: Install scripts split by OS (Darwin/Linux) for cleaner logic.
-- **Layered Architecture**: Refactored shell config into explicit layers:
-  - `00-core`: Safety/Paths
-  - `50-logic`: Functions/Toolchain
-  - `90-ux`: Aliases/Theme
-- **Trust & Reproducibility**:
-  - **Pinned Formulae**: Generated `Brewfile.lock.json` for strictly reproducible macOS builds.
-  - **Binary Pinning**: `install.sh` now enforces specific version tags for initial bootstrap.
-### 🔒 Security & Quality
-- **Conflict Resolution**: Detected and resolved **46 namespace collisions** across all alias modules (Git, Go, Archives, etc.) to ensure zero overlap.
-- **Git Safety**: Renamed colliding Go aliases (e.g., `gr` -> `gor`) to protect core Git commands.
-- **Modernization**: Merged `list` into `modern` for a cohesive Rust-based toolchain experience (`eza`, `bat`).
-- **Standardization**: Removed duplicate logging functions in favor of a shared utility.
-- **Documentation**: All 30+ component READMEs are now 100% accurate and verified.
-
-### 🛠️ Start-of-Art Toolchain
-- **Kubernetes**: Added `kubectl`, `helm`, `k9s` aliases.
-- **IaC**: Added `terraform`, `opentofu`, `ansible`.
-- **Languages**: Added ecosystem support for `go`, `yarn`, `uv` (modern Python).
-- **AI Integration**: Added wrappers for `gh copilot`, `fabric`, and local LLMs.
-- **Smart Help**: Introduced `dothelp` to strictly search and index custom functions.
-
-### 🤖 CI/CD & Testing
-
-- **Automated Testing**
-  - Docker CI (`ci-docker.yml`) running on Ubuntu/Fedora/Arch.
-  - Integration tests for alias syntax (`test-aliases.sh`).
-
-- **Enterprise Core & Security (The Trust Layer)**
-  - **SLSA & SBOM**: `security-release.yml` generates SPDX SBOMs and SLSA Level 3 Provenance.
-  - **Signing**: `enable-signing` wizard for GPG/SSH git signing.
-  - **Immutability**: `lock-configs` / `unlock-configs` to protect critical dotfiles (`chflags`/`chattr`).
-
-- **Legal & Licensing**
-  - **Compliance**: `scan-licenses` (FOSSology/Trivy), `check-cla` (GitHub checks).
-  - **Attribution**: `add-headers` automation and `gen-notice` generation.
-
-- **Self-Healing & Diagnostics**
-  - **Health**: `dot doctor` script diagnoses environment (Dependencies, XDG, Paths).
-  - **Repair**: `dot heal` / `dot drift` aliases for auto-repair and drift detection.
-
-- **Regulatory Compliance**
-  - **Documentation**: `COMPLIANCE.md` maps features to **SOC2 Type II** and **ISO 27001**.
-  - **Privacy**: `privacy-mode` alias disables CLI telemetry for 7+ frameworks.
-
-- **macOS Deep Integration**
-  - **Hardening**: `defaults` script secures screensaver, firewall, and finder settings.
-  - **Optimization**: Configures Safari for dev, removes Dock clutter.
-
-- **Font Typography**
-  - **Fonts**: Auto-installs `JetBrainsMono Nerd Font` and `Symbols Nerd Font`.
-  - **Rendering**: Linux `fontconfig` XML for sub-pixel antialiasing.
-
-- **Phase 58: Editor Unification (The Grand Vim)** (Implemented)
-  - **Neovim IDE**: Full VS Code feature parity (Noice, Lualine, Gitsigns, Indent-Blankline).
-  - **Language Support**: Optimized for Rust (Rustaceanvim) and Python (BasedPyright/Ruff).
-  - **Performance**: Lazy-loading architecture with `<30ms` startup.
-  - **CI/CD Fixes**: Resolved CodeQL alerts (removed legacy Node.js) and fixed Docker builds.
-
-- **OS Bundling & Compliance**
-  - **Packaging**: `scripts/package.sh` generates versioned distribution tarballs.
-  - **Enterprise**: `/etc/dotfiles/defaults.d` hooks for site-local config overrides.
-  - **Standards**: Strict **XDG Base Directory** enforcement in `paths.sh`.
-
-- **The Universal Installer (Zero-Dep)**
-  - **Bootstrap**: `install.sh` running via `curl | sh` with no dependencies.
-  - **Teleport**: `dot teleport user@host` to ephemerally deploy configs via SSH.
-
-### 🧪 Verification
-- **Performance**: Benchmark script `scripts/benchmark.sh` confirms <20ms startup.
-- **Integration**: `test-aliases.sh` verified syntax of all 32 alias modules.
-- **Security**: **Zero Critical Vulnerabilities** (CodeQL & Dependabot clean).
-- **Functionality**: Local migration verified on macOS, Linux, and WSL.
-
-
-### 📦 Installation & Migration
-
-#### Option A: Fresh Install (New Machines)
-If you are setting up a new machine, simply run the universal installer:
-```bash
-sh -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.471/install.sh)"
-```
-
-#### Option B: Migration (Upgrade from `master` / v1)
-⚠️ **Important**: This release changes the architecture from direct symlinks to `chezmoi` templates. Functional backups are recommended.
-**Compatibility Note**: Existing `chezmoi` users can simply run `chezmoi apply` to upgrade, but the full installer is recommended for major version jumps.
-
-1. **Backup Legacy Configs**:
-   ```bash
-   mv ~/.zshrc ~/.zshrc.bak
-   mv ~/.config/nvim ~/.config/nvim.bak
-   ```
-2. **Run Installer**:
-   ```bash
-   sh -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.471/install.sh)"
-   ```
-3. **Resolve Conflicts**:
-   - If prompted by `chezmoi` to overwrite files (e.g., `.zshrc`), select **overwrite** (or diff to check) as this release uses a new sourcing strategy.
-4. **Restart Shell**:
-   ```bash
-   exec zsh
-   ```