@sebastienrousseau/dotfiles 0.2.501 → 0.2.503

package/scripts/ci/install-chezmoi-verified.sh

@@ -1,64 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# Install a pinned Chezmoi release with checksum verification.
-set -euo pipefail
-
-VERSION="${1:-}"
-BIN_DIR="${2:-$HOME/.local/bin}"
-
-if [[ -z "$VERSION" ]]; then
-  echo "Usage: $0 <chezmoi-version> [bin-dir]" >&2
-  exit 1
-fi
-
-OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
-ARCH="$(uname -m)"
-
-case "$OS" in
-  linux | darwin) ;;
-  *)
-    echo "Unsupported OS: $OS" >&2
-    exit 1
-    ;;
-esac
-
-case "$ARCH" in
-  x86_64 | amd64) ARCH="amd64" ;;
-  arm64 | aarch64) ARCH="arm64" ;;
-  *)
-    echo "Unsupported architecture: $ARCH" >&2
-    exit 1
-    ;;
-esac
-
-ASSET="chezmoi_${VERSION}_${OS}_${ARCH}.tar.gz"
-CHECKSUMS_ASSET="chezmoi_${VERSION}_checksums.txt"
-BASE_URL="https://github.com/twpayne/chezmoi/releases/download/v${VERSION}"
-
-TMP_DIR="$(umask 077 && mktemp -d)"
-trap 'rm -rf "$TMP_DIR"' EXIT
-
-# Support both old and new checksum filenames.
-if ! curl -fsSL -o "$TMP_DIR/checksums.txt" "$BASE_URL/$CHECKSUMS_ASSET"; then
-  curl -fsSL -o "$TMP_DIR/checksums.txt" "$BASE_URL/checksums.txt"
-fi
-curl -fsSL -o "$TMP_DIR/$ASSET" "$BASE_URL/$ASSET"
-
-CHECKSUM_LINE="$(grep -E "[[:space:]]${ASSET}$" "$TMP_DIR/checksums.txt" | head -n1 || true)"
-if [[ -z "$CHECKSUM_LINE" ]]; then
-  echo "Checksum entry not found for $ASSET" >&2
-  exit 1
-fi
-
-(
-  cd "$TMP_DIR"
-  if command -v sha256sum >/dev/null 2>&1; then
-    echo "$CHECKSUM_LINE" | sha256sum -c -
-  else
-    echo "$CHECKSUM_LINE" | shasum -a 256 -c -
-  fi
-)
-
-tar -xzf "$TMP_DIR/$ASSET" -C "$TMP_DIR" chezmoi
-mkdir -p "$BIN_DIR"
-install -m 755 "$TMP_DIR/chezmoi" "$BIN_DIR/chezmoi"

package/scripts/ci/run-coverage.sh

@@ -1,362 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# =============================================================================
-# run-coverage.sh — Bash code-coverage runner using pure xtrace
-# instrumentation. Emits lcov.info at $COVERAGE_OUT.
-#
-# Why pure xtrace (not kcov):
-#   kcov v43 on Ubuntu 24.04 + bash 5.2 won't emit bash-script
-#   coverage in either mode: without bash-dbgsym it captures nothing,
-#   and with bash-dbgsym it captures bash's *C-binary* internals
-#   (ctype.h, stdio.h) instead of the .sh file lines we care about.
-#   We bypass kcov entirely by using bash's own xtrace mechanism:
-#
-#     PS4='+:${LINENO}:${BASH_SOURCE}:'   # encode line + file in trace
-#     BASH_ENV=/setup-that-runs-set-x      # turn on xtrace in every
-#                                          # non-interactive bash, so
-#                                          # children inherit tracing
-#     bash test.sh 2>traces/test.trace     # capture lines per test
-#
-#   Then we parse all traces with regex and write lcov.info. This is
-#   the same mechanism bashcov uses, minus the Ruby runtime.
-#
-# Linux + macOS both work (macOS bash 3.2 supports BASH_XTRACEFD as
-# well — verified locally on bash 5.3 via Homebrew). The pre-commit
-# hook in this repo can invoke this on any platform.
-#
-# Closes the runner half of #856 / Slice 1 of #883.
-# =============================================================================
-
-set -uo pipefail
-
-REPO_ROOT="${REPO_ROOT:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
-TESTS_DIR="${TESTS_DIR:-$REPO_ROOT/tests}"
-COVERAGE_DIR="${COVERAGE_DIR:-$REPO_ROOT/coverage}"
-COVERAGE_OUT="${COVERAGE_OUT:-$COVERAGE_DIR/lcov.info}"
-MIN_COVERAGE_PCT="${MIN_COVERAGE_PCT:-0}" # initial floor; tighten per slice
-COV_INCLUDE_DIRS="${COV_INCLUDE_DIRS:-$REPO_ROOT/scripts:$REPO_ROOT/dot_local/bin:$REPO_ROOT/.chezmoitemplates/functions}"
-JOBS="${JOBS:-$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 4)}"
-COV_TEST_TIMEOUT="${COV_TEST_TIMEOUT:-60}"
-
-mkdir -p "$COVERAGE_DIR"
-trace_dir="$COVERAGE_DIR/traces"
-rm -rf "$trace_dir"
-mkdir -p "$trace_dir"
-
-# -----------------------------------------------------------------------------
-# BASH_ENV setup file: enables xtrace in every non-interactive bash that
-# inherits it. Child processes spawned via `bash $SCRIPT` get their own
-# tracing turned on automatically.
-# -----------------------------------------------------------------------------
-bash_env="$COVERAGE_DIR/_cov_bashenv.sh"
-cat >"$bash_env" <<'SETUP'
-# coverage runtime — enable xtrace, define PS4 with file+line markers.
-# `${BASH_SOURCE:-}` (not `${BASH_SOURCE}`) prevents PS4 evaluation
-# from failing under `set -u`: at the top level of a `bash -c`
-# script, BASH_SOURCE[0] is unbound; an unguarded expansion under
-# `set -u` aborts the shell, taking out any test that sources a
-# `set -euo pipefail` library file.
-set -x
-PS4='+@COV@:${LINENO}:${BASH_SOURCE:-}:@ '
-SETUP
-
-# Sanity-probe: run one trivial script through the pipeline so a
-# subsequent failure of the real sweep can be diagnosed quickly.
-probe_target="$COVERAGE_DIR/_probe_target.sh"
-cat >"$probe_target" <<'PROBE'
-#!/usr/bin/env bash
-set -uo pipefail
-echo "probe-line-a"
-x=1; y=2
-echo "probe-sum=$((x + y))"
-PROBE
-chmod +x "$probe_target"
-
-PS4='+@COV@:${LINENO}:${BASH_SOURCE}:@ ' \
-  BASH_ENV="$bash_env" \
-  bash "$probe_target" 2>"$trace_dir/_probe.trace" >/dev/null || true
-probe_lines=$(grep -cE "^\+@COV@:[0-9]+:.*${probe_target}:@" "$trace_dir/_probe.trace" 2>/dev/null || echo 0)
-echo "probe: ${probe_lines} traced lines from ${probe_target}" >&2
-if [[ "$probe_lines" -eq 0 ]]; then
-  echo "::error::xtrace probe captured no lines — coverage mechanism broken" >&2
-  exit 2
-fi
-
-# -----------------------------------------------------------------------------
-# Collect test files (mirror tests/framework/test_runner.sh discovery).
-# -----------------------------------------------------------------------------
-mapfile -t test_files < <(find "$TESTS_DIR/unit" -name 'test_*.sh' -type f | sort)
-
-if [[ "${#test_files[@]}" -eq 0 ]]; then
-  echo "::error::no unit test files discovered under $TESTS_DIR/unit" >&2
-  exit 1
-fi
-
-echo "Tracing ${#test_files[@]} test files (parallel × $JOBS, timeout ${COV_TEST_TIMEOUT}s/test)..." >&2
-
-# -----------------------------------------------------------------------------
-# Worker function — runs one test under xtrace, captures stderr.
-# -----------------------------------------------------------------------------
-# shellcheck disable=SC2329  # called indirectly via xargs subshell
-run_one() {
-  local f="$1"
-  local trace
-  trace="$COV_TRACE_DIR/$(basename "$f" .sh).trace"
-  PS4='+@COV@:${LINENO}:${BASH_SOURCE}:@ ' \
-    BASH_ENV="$COV_BASH_ENV" \
-    timeout --kill-after=5 "$COV_TEST_TIMEOUT" \
-    bash "$f" 2>"$trace" >/dev/null || true
-}
-
-export COV_TRACE_DIR="$trace_dir"
-export COV_BASH_ENV="$bash_env"
-export COV_TEST_TIMEOUT
-export -f run_one
-
-start_ts=$(date +%s)
-printf '%s\n' "${test_files[@]}" |
-  xargs -I{} -n1 -P"$JOBS" bash -c 'run_one "$@"' _ {} ||
-  true
-elapsed=$(($(date +%s) - start_ts))
-echo "trace phase done in ${elapsed}s" >&2
-
-# -----------------------------------------------------------------------------
-# Aggregate trace files → lcov.info.
-# -----------------------------------------------------------------------------
-python3 - "$COVERAGE_OUT" "$trace_dir" "$REPO_ROOT" "$COV_INCLUDE_DIRS" <<'PY'
-"""Aggregate bash xtrace output into lcov.info."""
-import os
-import re
-import sys
-from collections import defaultdict
-from pathlib import Path
-
-out_path, trace_dir, repo_root, include_dirs_spec = sys.argv[1:5]
-include_dirs = [Path(p).resolve() for p in include_dirs_spec.split(":") if p]
-trace_dir = Path(trace_dir)
-repo_root = Path(repo_root).resolve()
-
-# Pattern: +@COV@:<lineno>:<source>:@
-hit_re = re.compile(r"^\+@COV@:(\d+):([^:]+):@")
-
-# files[abs_path][line] = total hits
-files = defaultdict(lambda: defaultdict(int))
-
-def in_includes(path: Path) -> bool:
-    try:
-        rp = path.resolve()
-    except (OSError, RuntimeError):
-        return False
-    for inc in include_dirs:
-        try:
-            rp.relative_to(inc)
-            return True
-        except ValueError:
-            continue
-    return False
-
-# Parse every trace file. Each trace can be MBs; iterate line by line.
-for trace_path in sorted(trace_dir.glob("*.trace")):
-    try:
-        with open(trace_path, "r", errors="replace") as f:
-            for line in f:
-                m = hit_re.match(line)
-                if not m:
-                    continue
-                lineno = int(m.group(1))
-                src = m.group(2).strip()
-                if not src or src == "main":
-                    continue
-                src_path = Path(src)
-                if not src_path.is_absolute():
-                    src_path = (repo_root / src_path)
-                # Always resolve so `..`-style paths from inside
-                # `commands/foo.sh` sourcing `../lib/log.sh` collapse
-                # to the same canonical SF: key as a direct hit on
-                # `lib/log.sh`. Without this we get three SF: blocks
-                # for one file and the denominator inflates.
-                try:
-                    src_path = src_path.resolve()
-                except (OSError, RuntimeError):
-                    pass
-                if not in_includes(src_path):
-                    continue
-                files[str(src_path)][lineno] += 1
-    except OSError as e:
-        print(f"warn: read error {trace_path}: {e}", file=sys.stderr)
-
-# Sweep through include-dirs and add executable lines for files we never
-# touched, so lcov coverage % reflects total source surface, not just
-# touched files.
-ws_re = re.compile(r"^\s*$")
-comment_re = re.compile(r"^\s*#")
-shebang_re = re.compile(r"^\s*#!")
-
-def executable_lines(path: Path):
-    """Lines that bash xtrace can plausibly emit.
-
-    Excludes:
-      - blanks / shebangs / comments (already)
-      - structural-only keywords (`fi`, `done`, `else`, `esac`, `then`,
-        `do`, `in`, bare `{`/`}` braces) — these are syntax, not
-        commands; xtrace never traces them
-      - heredoc body lines (between `<<EOF` and `EOF`) — content, not
-        executed
-      - `case` pattern labels (`foo)`) — the matched body executes,
-        not the pattern itself
-
-    This matches what `bash -x` actually produces a `+`-prefixed
-    line for, so the denominator reflects measurable lines.
-
-    Honor LCOV_EXCL_LINE / LCOV_EXCL_START / LCOV_EXCL_STOP markers
-    so authors can exempt genuinely unreachable lines (platform-
-    gated branches, root-only paths, dead-code stubs).
-    """
-    import re as _re
-    structural = _re.compile(
-        r"^\s*("
-        r"fi|done|else|elif|esac|then|do|in|"
-        r"\}|\{|"
-        r"\)\s*;?;?\s*$|"        # bare `)` (case pattern close)
-        r";;\s*$"                # `;;` case-clause terminator
-        r")\s*(#.*)?$"
-    )
-    case_pattern = _re.compile(r"^\s*[a-zA-Z0-9_\*\?\[\|/\-\.+]+\)\s*(#.*)?$")
-    heredoc_open = _re.compile(r"<<-?\s*[\"\']?([A-Za-z_][A-Za-z0-9_]*)[\"\']?")
-    excl_line = _re.compile(r"#\s*LCOV_EXCL_LINE")
-    excl_start = _re.compile(r"#\s*LCOV_EXCL_START")
-    excl_stop = _re.compile(r"#\s*LCOV_EXCL_STOP")
-    # Scripts that explicitly turn off xtrace can't be measured by
-    # this mechanism — the bash runtime simply stops emitting trace
-    # records. Treat everything after `set +x` / `set +o xtrace`
-    # as excluded so it doesn't sink the denominator.
-    xtrace_off = _re.compile(r"^\s*set\s+(\+x|\+o\s+xtrace)\b")
-
-    try:
-        with open(path, "r", errors="replace") as f:
-            text = f.read().splitlines()
-    except OSError:
-        return []
-
-    out = []
-    in_heredoc = None  # the terminator we're waiting for
-    excluding = False
-    xtrace_disabled = False
-    for i, line in enumerate(text, 1):
-        # LCOV_EXCL handling
-        if excl_start.search(line):
-            excluding = True
-            continue
-        if excl_stop.search(line):
-            excluding = False
-            continue
-        if excluding:
-            continue
-        if excl_line.search(line):
-            continue
-
-        # Once a script disables xtrace, no further lines can be
-        # measured by this mechanism — drop them from the denominator.
-        if xtrace_disabled:
-            continue
-        if xtrace_off.match(line):
-            xtrace_disabled = True
-            continue
-
-        # Heredoc body — track and skip
-        if in_heredoc is not None:
-            if line.strip() == in_heredoc:
-                in_heredoc = None
-            continue
-        hd = heredoc_open.search(line)
-        if hd and not comment_re.match(line):
-            in_heredoc = hd.group(1)
-
-        if not line or ws_re.match(line):
-            continue
-        if shebang_re.match(line):
-            continue
-        if comment_re.match(line):
-            continue
-        if structural.match(line):
-            continue
-        if case_pattern.match(line):
-            continue
-        out.append(i)
-    return out
-
-for inc in include_dirs:
-    if not inc.exists():
-        continue
-    for path in inc.rglob("*.sh"):
-        ap = str(path.resolve())
-        existing = files[ap]  # creates the entry on touch
-        for ln in executable_lines(path):
-            if ln not in existing:
-                existing[ln] = 0
-    for path in inc.rglob("*"):
-        # also include shebanged shell scripts without .sh
-        if path.is_file() and not path.suffix and path.stat().st_size > 0:
-            try:
-                with open(path, "r", errors="replace") as f:
-                    first = f.readline()
-            except OSError:
-                continue
-            if first.startswith("#!") and ("bash" in first or "sh" in first):
-                ap = str(path.resolve())
-                existing = files[ap]
-                for ln in executable_lines(path):
-                    if ln not in existing:
-                        existing[ln] = 0
-
-# Emit lcov.info
-with open(out_path, "w") as out:
-    for filename in sorted(files):
-        out.write(f"SF:{filename}\n")
-        for ln in sorted(files[filename]):
-            out.write(f"DA:{ln},{files[filename][ln]}\n")
-        out.write("end_of_record\n")
-
-# Summary
-total_files = len(files)
-total_lines = sum(len(lines) for lines in files.values())
-covered = sum(1 for lines in files.values() for h in lines.values() if h > 0)
-pct = (covered * 100.0 / total_lines) if total_lines else 0.0
-print(f"Aggregated: {total_files} files, {covered}/{total_lines} lines = {pct:.2f}%",
-      file=sys.stderr)
-PY
-
-if [[ ! -s "$COVERAGE_OUT" ]]; then
-  echo "::error::failed to produce lcov.info — aggregator wrote empty file." >&2
-  exit 1
-fi
-
-# -----------------------------------------------------------------------------
-# Threshold check.
-# -----------------------------------------------------------------------------
-summary=$(
-  python3 - "$COVERAGE_OUT" <<'PY'
-import sys
-total = covered = 0
-with open(sys.argv[1]) as f:
-    for line in f:
-        if line.startswith("DA:"):
-            _, rest = line.split(":", 1)
-            _, hits = rest.strip().split(",")
-            total += 1
-            if int(hits) > 0:
-                covered += 1
-pct = (covered * 100.0 / total) if total else 0.0
-print(f"{covered} {total} {pct:.2f}")
-PY
-)
-read -r covered total pct <<<"$summary"
-echo "Coverage: ${covered}/${total} lines = ${pct}% (output: $COVERAGE_OUT)"
-
-below=$(awk -v p="$pct" -v t="$MIN_COVERAGE_PCT" 'BEGIN{print (p+0 < t+0) ? "1" : "0"}')
-if [[ "$below" == "1" ]]; then
-  echo "::error::coverage ${pct}% is below the floor ${MIN_COVERAGE_PCT}%" >&2
-  exit 1
-fi
-
-exit 0

package/scripts/ci/validate-chezmoidata.sh

@@ -1,25 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# Validate .chezmoidata.toml against config/chezmoidata.schema.json via taplo.
-#
-# Usage:
-#   bash scripts/ci/validate-chezmoidata.sh
-#
-# In CI the workflow installs taplo before invoking this script. Locally,
-# install via: cargo install --locked taplo-cli  (or `brew install taplo`).
-
-set -euo pipefail
-
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "$REPO_ROOT"
-
-if ! command -v taplo >/dev/null 2>&1; then
-  echo "error: taplo not found in PATH" >&2
-  echo "  install: cargo install --locked taplo-cli" >&2
-  echo "      or: brew install taplo" >&2
-  exit 127
-fi
-
-# `taplo check` reads .taplo.toml at the repo root, applies the schema
-# rule, and reports schema violations + TOML syntax errors.
-taplo check

package/scripts/ci/validate-ci-config.sh

@@ -1,224 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# CI Configuration Validation Script
-# Verifies that all zero-warning policy components are properly configured
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(dirname "$(dirname "$SCRIPT_DIR")")"
-
-# Colors for output (respect NO_COLOR: https://no-color.org)
-if [[ -z "${NO_COLOR:-}" ]] && [[ -t 1 ]]; then
-  RED='\033[0;31m' GREEN='\033[0;32m' YELLOW='\033[0;33m'
-  BLUE='\033[0;34m' NC='\033[0m'
-else
-  RED='' GREEN='' YELLOW='' BLUE='' NC=''
-fi
-
-printf '%b\n' "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-printf '%b\n' "${BLUE}      CI CONFIGURATION VALIDATOR      ${NC}"
-printf '%b\n' "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-echo ""
-
-ERRORS=0
-WARNINGS=0
-
-# Helper functions
-check_file_exists() {
-  local file="$1"
-  local description="$2"
-
-  if [[ -f "$file" ]]; then
-    printf '%b\n' "  ${GREEN}✓${NC} $description"
-    return 0
-  else
-    printf '%b\n' "  ${RED}✗${NC} $description"
-    ((ERRORS++))
-    return 1
-  fi
-}
-
-check_pattern_in_file() {
-  local file="$1"
-  local pattern="$2"
-  local description="$3"
-
-  if [[ -f "$file" ]] && grep -q "$pattern" "$file"; then
-    printf '%b\n' "  ${GREEN}✓${NC} $description"
-    return 0
-  else
-    printf '%b\n' "  ${RED}✗${NC} $description"
-    ((ERRORS++))
-    return 1
-  fi
-}
-
-warn_if_pattern() {
-  local file="$1"
-  local pattern="$2"
-  local description="$3"
-
-  if [[ -f "$file" ]] && grep -q "$pattern" "$file"; then
-    printf '%b\n' "  ${YELLOW}⚠${NC} $description"
-    ((WARNINGS++))
-    return 1
-  else
-    printf '%b\n' "  ${GREEN}✓${NC} $description"
-    return 0
-  fi
-}
-
-# Check 1: Core CI files exist
-printf '%b\n' "${BLUE}1. Core CI Files${NC}"
-check_file_exists "$REPO_ROOT/.github/workflows/ci.yml" "Main CI workflow exists"
-check_file_exists "$REPO_ROOT/.github/workflows/nightly.yml" "Nightly workflow exists"
-check_file_exists "$REPO_ROOT/.github/workflows/security-enhanced.yml" "Security workflow exists"
-check_file_exists "$REPO_ROOT/config/pre-commit-config.yaml" "Pre-commit configuration exists"
-echo ""
-
-# Check 2: Zero-warning enforcement
-printf '%b\n' "${BLUE}2. Zero-Warning Policy Enforcement${NC}"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "zero-warning" "Zero-warning policy documented"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "fail on unformatted code" "Formatter failure enforced"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "warnings-as-errors" "Warnings treated as errors"
-
-# Verify no || true patterns in security steps
-warn_if_pattern "$REPO_ROOT/.github/workflows/ci.yml" "gitleaks.*||.*true" "Gitleaks bypass detected"
-warn_if_pattern "$REPO_ROOT/.github/workflows/ci.yml" "shellcheck.*||.*true" "Shellcheck bypass detected"
-echo ""
-
-# Check 3: Test coverage requirements
-printf '%b\n' "${BLUE}3. Test Coverage Requirements${NC}"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "100%" "100% coverage requirement"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "fail-under" "Coverage threshold enforcement"
-
-if [[ -f "$REPO_ROOT/tests/framework/test_runner.sh" ]]; then
-  printf '%b\n' "  ${GREEN}✓${NC} Test framework exists"
-else
-  printf '%b\n' "  ${RED}✗${NC} Test framework missing"
-  ((ERRORS++))
-fi
-echo ""
-
-# Check 4: Security scanning
-printf '%b\n' "${BLUE}4. Security Scanning Configuration${NC}"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "security-secrets" "Secret scanning enabled"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "security-dependencies" "Dependency audit enabled"
-check_pattern_in_file "$REPO_ROOT/config/pre-commit-config.yaml" "gitleaks" "Pre-commit secret scanning"
-check_pattern_in_file "$REPO_ROOT/config/pre-commit-config.yaml" "detect-secrets" "Advanced secret detection"
-
-# Verify no piped execution patterns
-warn_if_pattern "$REPO_ROOT/.github/workflows/ci.yml" "curl.*|.*sh" "Dangerous piped execution"
-warn_if_pattern "$REPO_ROOT/.github/workflows/ci.yml" "wget.*|.*bash" "Dangerous piped execution"
-echo ""
-
-# Check 5: Performance monitoring
-printf '%b\n' "${BLUE}5. Performance Monitoring${NC}"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "benchmark" "Performance benchmarking enabled"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "500ms" "Shell startup threshold defined"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/nightly.yml" "performance-tracking" "Nightly performance tracking"
-echo ""
-
-# Check 6: Multi-OS support
-printf '%b\n' "${BLUE}6. Multi-OS Testing${NC}"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "ubuntu-latest" "Linux testing enabled"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "macos-latest" "macOS testing enabled"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/nightly.yml" "matrix:" "OS matrix testing configured"
-echo ""
-
-# Check 7: Timeouts and efficiency
-printf '%b\n' "${BLUE}7. Timeout and Efficiency Settings${NC}"
-if grep -q "timeout-minutes: [0-9]" "$REPO_ROOT/.github/workflows/ci.yml"; then
-  MAX_TIMEOUT=$(grep "timeout-minutes:" "$REPO_ROOT/.github/workflows/ci.yml" |
-    awk '{print $2}' | sort -n | tail -1)
-  if [[ $MAX_TIMEOUT -le 15 ]]; then
-    printf '%b\n' "  ${GREEN}✓${NC} Job timeouts properly configured (max: ${MAX_TIMEOUT}min)"
-  else
-    printf '%b\n' "  ${YELLOW}⚠${NC} Some jobs have long timeouts (max: ${MAX_TIMEOUT}min)"
-    ((WARNINGS++))
-  fi
-else
-  printf '%b\n' "  ${RED}✗${NC} No timeout configuration found"
-  ((ERRORS++))
-fi
-
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "cache" "Dependency caching enabled"
-echo ""
-
-# Check 8: Branch protection readiness
-printf '%b\n' "${BLUE}8. Branch Protection Readiness${NC}"
-check_file_exists "$REPO_ROOT/.github/BRANCH_PROTECTION.md" "Branch protection documentation"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "quality-gate" "Quality gate job defined"
-
-# Check for required status check names
-REQUIRED_CHECKS=(
-  "lint-shell"
-  "security-secrets"
-  "security-dependencies"
-  "test-unit"
-  "quality-gate"
-)
-
-for check in "${REQUIRED_CHECKS[@]}"; do
-  if grep -q "name:.*$check" "$REPO_ROOT/.github/workflows/ci.yml"; then
-    printf '%b\n' "  ${GREEN}✓${NC} Required check '$check' defined"
-  else
-    printf '%b\n' "  ${RED}✗${NC} Required check '$check' missing"
-    ((ERRORS++))
-  fi
-done
-echo ""
-
-# Check 9: Nightly extended testing
-printf '%b\n' "${BLUE}9. Nightly Extended Testing${NC}"
-if [[ -f "$REPO_ROOT/.github/workflows/nightly.yml" ]]; then
-  check_pattern_in_file "$REPO_ROOT/.github/workflows/nightly.yml" "dependency-updates" "Dependency monitoring"
-  check_pattern_in_file "$REPO_ROOT/.github/workflows/nightly.yml" "beta-tools-test" "Beta tool testing"
-  check_pattern_in_file "$REPO_ROOT/.github/workflows/nightly.yml" "security-extended" "Extended security scanning"
-  check_pattern_in_file "$REPO_ROOT/.github/workflows/nightly.yml" "cron:" "Scheduled execution"
-else
-  printf '%b\n' "  ${RED}✗${NC} Nightly workflow missing"
-  ((ERRORS++))
-fi
-echo ""
-
-# Final summary
-printf '%b\n' "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-printf '%b\n' "${BLUE}           VALIDATION SUMMARY         ${NC}"
-printf '%b\n' "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-
-if [[ $ERRORS -eq 0 ]] && [[ $WARNINGS -eq 0 ]]; then
-  printf '%b\n' "${GREEN}✅ PERFECT: CI configuration fully compliant${NC}"
-  echo "   - Zero-warning policy properly enforced"
-  echo "   - All security gates configured"
-  echo "   - Performance monitoring active"
-  echo "   - Ready for branch protection"
-elif [[ $ERRORS -eq 0 ]]; then
-  printf '%b\n' "${YELLOW}⚠️  GOOD: CI mostly compliant with $WARNINGS warning(s)${NC}"
-  echo "   - Core functionality working"
-  echo "   - Minor improvements recommended"
-else
-  printf '%b\n' "${RED}❌ ISSUES: CI configuration has $ERRORS error(s) and $WARNINGS warning(s)${NC}"
-  echo "   - Critical fixes required before deployment"
-fi
-
-echo ""
-echo "Configuration Details:"
-echo "  - Repository: $REPO_ROOT"
-echo "  - Main CI: .github/workflows/ci.yml"
-echo "  - Nightly: .github/workflows/nightly.yml"
-echo "  - Pre-commit: config/pre-commit-config.yaml"
-echo ""
-echo "Next Steps:"
-if [[ $ERRORS -gt 0 ]]; then
-  echo "  1. Fix critical errors listed above"
-  echo "  2. Re-run validation: $0"
-fi
-if [[ $WARNINGS -gt 0 ]]; then
-  echo "  3. Address warnings for optimal configuration"
-fi
-echo "  4. Configure branch protection rules per BRANCH_PROTECTION.md"
-echo "  5. Test CI pipeline with a small PR"
-
-exit $ERRORS