@sebastienrousseau/dotfiles 0.2.501 → 0.2.502

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (65) hide show
  1. package/CHANGELOG.md +77 -0
  2. package/README.md +38 -8
  3. package/docs/COPYRIGHT +1 -1
  4. package/docs/index.md +2 -2
  5. package/docs/manual/00-introduction.md +1 -1
  6. package/docs/manual/03-reference/01-dot-cli.md +63 -45
  7. package/docs/manual/03-reference/02-config-files.md +2 -2
  8. package/docs/manual/03-reference/05-feature-flags.md +62 -3
  9. package/docs/manual/_toc.yml +1 -1
  10. package/docs/manual/command-index.md +12 -8
  11. package/docs/manual/index.md +66 -0
  12. package/docs/operations/COVERAGE.md +36 -2
  13. package/docs/operations/HARD_AUDIT_2026.md +631 -0
  14. package/docs/operations/REGISTRY.md +89 -0
  15. package/docs/operations/ROADMAP_2026.md +665 -0
  16. package/docs/operations/TRACEABILITY.md +3 -0
  17. package/docs/operations/VERSION_SYNC.md +4 -4
  18. package/docs/reference/POWERSHELL_PARITY.md +80 -0
  19. package/docs/registry.json +6 -0
  20. package/docs/security/CI_PINNING.md +113 -0
  21. package/docs/security/COMMIT_SIGNING.md +138 -0
  22. package/docs/security/DISCLOSURE.md +130 -0
  23. package/docs/security/KEY_ROTATION.md +81 -1
  24. package/docs/security/SCORECARD.md +74 -14
  25. package/docs/security/security-pubkey.asc +15 -0
  26. package/dot_config/fish/conf.d/direnv.fish +4 -0
  27. package/dot_config/fish/conf.d/mise-activate.fish +5 -0
  28. package/dot_config/git/hooks/executable_commit-msg +1 -1
  29. package/dot_config/shell/00-core-paths.sh.tmpl +8 -1
  30. package/dot_config/shell/README.md +1 -1
  31. package/dot_config/zsh/dot_zshrc.tmpl +57 -4
  32. package/dot_config/zsh/rc.d/30-options.zsh.tmpl +1 -1
  33. package/dot_local/bin/executable_dot +49 -9
  34. package/dot_local/bin/executable_dot-bootstrap +0 -1
  35. package/dot_local/bin/executable_dot-theme-sync +8 -8
  36. package/dot_local/bin/executable_tour +2 -2
  37. package/dot_local/share/man/man1/dot.1 +1 -1
  38. package/dot_local/share/zsh/completions/_dot +4 -0
  39. package/install.sh +44 -37
  40. package/package.json +1 -1
  41. package/scripts/ci/dot-cli-startup-bench.sh +126 -0
  42. package/scripts/ci/install-chezmoi-verified.sh +4 -1
  43. package/scripts/ci/lint-reusable-pins.sh +78 -0
  44. package/scripts/ci/run-coverage.sh +89 -0
  45. package/scripts/ci/windows-smoke-test.ps1 +136 -0
  46. package/scripts/diagnostics/doctor.sh +39 -9
  47. package/scripts/dot/commands/agent.sh +19 -22
  48. package/scripts/dot/commands/agents.sh +325 -0
  49. package/scripts/dot/commands/aliases.sh +10 -8
  50. package/scripts/dot/commands/core.sh +10 -4
  51. package/scripts/dot/commands/fleet.sh +278 -3
  52. package/scripts/dot/commands/init.sh +184 -0
  53. package/scripts/dot/commands/meta.sh +7 -4
  54. package/scripts/dot/commands/registry.sh +263 -0
  55. package/scripts/dot/commands/tools.sh +49 -1
  56. package/scripts/dot/lib/bento.sh +1 -1
  57. package/scripts/dot/lib/platform.sh +21 -8
  58. package/scripts/dot/lib/ui.sh +134 -2
  59. package/scripts/dot/lib/utils.sh +1 -1
  60. package/scripts/git-hooks/pre-commit-audit.sh +1 -1
  61. package/scripts/lib/secrets_provider.sh +32 -6
  62. package/scripts/ops/rollback.sh +14 -0
  63. package/scripts/security/check-disclosure-key-expiry.sh +110 -0
  64. package/scripts/security/lock-configs.sh +11 -2
  65. package/scripts/version-sync.sh +3 -0
@@ -52,8 +52,8 @@ matches and emits standard `lcov.info` that Codecov ingests natively.
52
52
  `MIN_COVERAGE_PCT=0` in `.github/workflows/coverage.yml`. Slice 1
53
53
  of [#883](https://github.com/sebastienrousseau/dotfiles/issues/883)
54
54
  established the baseline at **~2.7% measured** (~613 of ~22 500 lines
55
- across 231 files). Each subsequent slice raises the floor by ~10–15
56
- percentage points until the target of ≥95% is reached.
55
+ across 231 files). Successive slices raised it; the current measured
56
+ value sits at **~47%**.
57
57
 
58
58
  To tighten:
59
59
 
@@ -64,6 +64,40 @@ To tighten:
64
64
  per bump.
65
65
  4. Note the floor change in the commit message + this page.
66
66
 
67
+ ### Why not the 95% target from #883
68
+
69
+ The roadmap originally targeted ≥95% measured. After working through
70
+ all six slices, the achievable ceiling with xtrace-only instrumentation
71
+ is closer to **~50%** on this codebase. The remaining gap is structural,
72
+ not aspirational:
73
+
74
+ - **System-mutation surface** — large parts of the repo orchestrate
75
+ real OS state (`chezmoi apply`, `gpg`, `pass`/`age` keystores,
76
+ `gsettings`, signal-driven app reload, `git reset --hard`,
77
+ filesystem backups). Exercising these requires either a destroyable
78
+ sandbox (Docker / VM) or per-call mocks for every system tool.
79
+ - **Platform-gated branches** — every diagnostic and theme script
80
+ has Darwin / Linux / WSL forks. The xtrace runner only sees the
81
+ fork for the host it ran on; the others remain "uncovered"
82
+ forever from that one run's perspective. CI runs both macOS and
83
+ Linux but reports them separately.
84
+ - **Interactive UIs** — `fzf`, `gum`, `cmatrix`, `niri`, and the
85
+ Ghostty/Tmux reload helpers can't return to the test under
86
+ `bash -x` within a timeout budget. These are excluded at the
87
+ aggregator level.
88
+ - **Animated demo helpers** — same as interactive UIs.
89
+
90
+ `scripts/ci/run-coverage.sh` has a `SKIP_PATHS` set that removes
91
+ genuinely-untestable scripts from the lcov denominator. Within the
92
+ files that remain, individual mutation-only function bodies are
93
+ fenced with `# LCOV_EXCL_START` / `# LCOV_EXCL_STOP` and a one-line
94
+ rationale comment. Every exclusion line names the reason (`rm -rf
95
+ real $HOME`, `signals live apps`, `gpg keystore`, etc.) so future
96
+ maintainers can re-evaluate if the test infrastructure changes.
97
+
98
+ The graduated approach in this doc replaces the original 95% target.
99
+ The honest floor is the achievable one.
100
+
67
101
  ## Running locally
68
102
 
69
103
  ```bash