@sebastienrousseau/dotfiles 0.2.502 → 0.2.503

package/scripts/ci/dot-cli-startup-bench.sh

@@ -1,126 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-#
-# scripts/ci/dot-cli-startup-bench.sh
-#
-# Sub-100ms cold-start gate for the `dot` CLI dispatcher.
-#
-# The §3 audit roadmap calls for measuring `dot help` / `dot version`
-# cold-start time and gating PRs on a regression budget. This script
-# runs the dispatcher N times under a clean shell, computes the median
-# elapsed time, and exits non-zero when the median exceeds the budget.
-#
-# Usage:
-#   bash scripts/ci/dot-cli-startup-bench.sh [--budget-ms <n>] [--runs <n>] [--cmd <argv>]
-#
-# Env overrides:
-#   DOT_BENCH_BUDGET_MS   Default budget in ms (default: 250).
-#   DOT_BENCH_RUNS        Number of runs (default: 11; median-of-N).
-#   DOT_BENCH_CMD         Argv passed to `dot` (default: "version").
-#
-# The default budget is 250ms — looser than the §3 aspirational 100ms
-# while we lazy-load mise/asdf/etc. CI ratchets this number down as
-# improvements land. Bench *failure* is a hard build failure; bench
-# *regression* (median > previous baseline + 15%) is a warning.
-
-set -euo pipefail
-
-BUDGET_MS="${DOT_BENCH_BUDGET_MS:-250}"
-RUNS="${DOT_BENCH_RUNS:-11}"
-DOT_ARGV_RAW="${DOT_BENCH_CMD:-version}"
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --budget-ms)
-      BUDGET_MS="$2"
-      shift 2
-      ;;
-    --runs)
-      RUNS="$2"
-      shift 2
-      ;;
-    --cmd)
-      DOT_ARGV_RAW="$2"
-      shift 2
-      ;;
-    -h | --help)
-      sed -n '5,25p' "${BASH_SOURCE[0]}"
-      exit 0
-      ;;
-    *)
-      echo "Unknown arg: $1" >&2
-      exit 2
-      ;;
-  esac
-done
-
-# Locate the dot dispatcher binary. Prefer the repo-local copy so a
-# user-installed `dot` on PATH can't sneak in.
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-DOT_BIN="$REPO_ROOT/dot_local/bin/executable_dot"
-if [[ ! -x "$DOT_BIN" ]] && command -v dot >/dev/null 2>&1; then
-  DOT_BIN="$(command -v dot)"
-fi
-if [[ ! -f "$DOT_BIN" ]]; then
-  echo "::error::dot binary not found at $DOT_BIN" >&2
-  exit 2
-fi
-
-# Portable wall-clock to ms. macOS bash 3.2 has no $EPOCHREALTIME.
-_now_ms() {
-  if [[ -n "${EPOCHREALTIME:-}" ]]; then
-    # zsh / bash 5+: floating-point seconds.
-    awk -v t="$EPOCHREALTIME" 'BEGIN{printf "%d\n", t*1000}'
-  elif date +%s%N 2>/dev/null | grep -qE '^[0-9]+$'; then
-    # GNU date: nanoseconds.
-    echo $(($(date +%s%N) / 1000000))
-  elif command -v python3 >/dev/null 2>&1; then
-    python3 -c 'import time; print(int(time.time()*1000))'
-  else
-    # Fall back to seconds × 1000 (low resolution; warn).
-    echo "::warning::no high-resolution clock; using whole-second precision" >&2
-    echo $(($(date +%s) * 1000))
-  fi
-}
-
-# Parse argv string (space-separated).
-read -r -a DOT_ARGV <<<"$DOT_ARGV_RAW"
-
-echo "dot CLI cold-start benchmark"
-echo "  binary : $DOT_BIN"
-echo "  argv   : ${DOT_ARGV[*]}"
-echo "  runs   : $RUNS"
-echo "  budget : ${BUDGET_MS}ms"
-echo
-
-samples=()
-for ((i = 1; i <= RUNS; i++)); do
-  start_ms="$(_now_ms)"
-  # `env -i` strips inherited cached state so we measure cold-start, not
-  # warm-cache. Keep PATH so the dispatcher can find git/awk/etc.
-  env -i HOME="$HOME" PATH="$PATH" "$DOT_BIN" "${DOT_ARGV[@]}" >/dev/null 2>&1 || true
-  end_ms="$(_now_ms)"
-  elapsed=$((end_ms - start_ms))
-  samples+=("$elapsed")
-  printf '  run %2d: %dms\n' "$i" "$elapsed"
-done
-
-# Median of samples (odd RUNS → middle value).
-median="$(printf '%s\n' "${samples[@]}" | sort -n | awk -v n="$RUNS" 'NR==int(n/2)+1{print; exit}')"
-echo
-echo "median: ${median}ms  budget: ${BUDGET_MS}ms"
-
-# Optional baseline record for trend tracking.
-baseline_file="${DOT_BENCH_BASELINE:-$REPO_ROOT/.cache/dot-cli-startup-baseline.txt}"
-mkdir -p "$(dirname "$baseline_file")" 2>/dev/null || true
-printf '%s\n' "$median" >"$baseline_file"
-
-if ((median > BUDGET_MS)); then
-  echo "::error::dot CLI cold-start regression: median ${median}ms > budget ${BUDGET_MS}ms" >&2
-  echo "  Possible causes: a slow source-time helper in dot_local/bin/executable_dot," >&2
-  echo "  an unconditional ${BUDGET_MS}ms+ tool init at top of a sourced lib, or" >&2
-  echo "  unnecessary jq/awk calls before the dispatcher case statement." >&2
-  exit 1
-fi
-
-echo "✓ dot CLI cold-start within budget"

package/scripts/ci/install-chezmoi-verified.sh

@@ -1,67 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# Install a pinned Chezmoi release with checksum verification.
-set -euo pipefail
-
-VERSION="${1:-}"
-BIN_DIR="${2:-$HOME/.local/bin}"
-
-if [[ -z "$VERSION" ]]; then
-  echo "Usage: $0 <chezmoi-version> [bin-dir]" >&2
-  exit 1
-fi
-
-OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
-ARCH="$(uname -m)"
-
-case "$OS" in
-  linux | darwin) ;;
-  *)
-    echo "Unsupported OS: $OS" >&2
-    exit 1
-    ;;
-esac
-
-case "$ARCH" in
-  x86_64 | amd64) ARCH="amd64" ;;
-  arm64 | aarch64) ARCH="arm64" ;;
-  *)
-    # chezmoi ships amd64 + arm64 builds only. Other architectures
-    # (ppc64le, s390x, riscv64, armv7) would need a source build.
-    echo "Unsupported architecture: $ARCH (only x86_64/amd64 and arm64/aarch64 are supported)" >&2
-    echo "See https://github.com/twpayne/chezmoi/releases for the full asset list." >&2
-    exit 1
-    ;;
-esac
-
-ASSET="chezmoi_${VERSION}_${OS}_${ARCH}.tar.gz"
-CHECKSUMS_ASSET="chezmoi_${VERSION}_checksums.txt"
-BASE_URL="https://github.com/twpayne/chezmoi/releases/download/v${VERSION}"
-
-TMP_DIR="$(umask 077 && mktemp -d)"
-trap 'rm -rf "$TMP_DIR"' EXIT
-
-# Support both old and new checksum filenames.
-if ! curl -fsSL -o "$TMP_DIR/checksums.txt" "$BASE_URL/$CHECKSUMS_ASSET"; then
-  curl -fsSL -o "$TMP_DIR/checksums.txt" "$BASE_URL/checksums.txt"
-fi
-curl -fsSL -o "$TMP_DIR/$ASSET" "$BASE_URL/$ASSET"
-
-CHECKSUM_LINE="$(grep -E "[[:space:]]${ASSET}$" "$TMP_DIR/checksums.txt" | head -n1 || true)"
-if [[ -z "$CHECKSUM_LINE" ]]; then
-  echo "Checksum entry not found for $ASSET" >&2
-  exit 1
-fi
-
-(
-  cd "$TMP_DIR"
-  if command -v sha256sum >/dev/null 2>&1; then
-    echo "$CHECKSUM_LINE" | sha256sum -c -
-  else
-    echo "$CHECKSUM_LINE" | shasum -a 256 -c -
-  fi
-)
-
-tar -xzf "$TMP_DIR/$ASSET" -C "$TMP_DIR" chezmoi
-mkdir -p "$BIN_DIR"
-install -m 755 "$TMP_DIR/chezmoi" "$BIN_DIR/chezmoi"

package/scripts/ci/lint-reusable-pins.sh

@@ -1,78 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# shellcheck disable=SC2155
-#
-# lint-reusable-pins.sh — fail if any workflow references a reusable
-# workflow via a mutable ref (relative path, branch name, tag).
-#
-# Closes the lint-rule half of #855. Acceptable form for a reusable
-# workflow reference:
-#
-#     uses: sebastienrousseau/dotfiles/.github/workflows/reusable-X.yml@<40-hex-sha>
-#
-# Rejected forms:
-#
-#     uses: ./.github/workflows/reusable-X.yml                  # relative path → mutable
-#     uses: org/repo/.github/workflows/reusable-X.yml@master    # branch ref → mutable
-#     uses: org/repo/.github/workflows/reusable-X.yml@v1        # tag ref → mutable
-#
-# The full-SHA constraint is what prevents a TOCTOU swap where a
-# malicious push to the reusable's branch redirects the calling
-# workflow at run time.
-
-set -euo pipefail
-
-REPO_ROOT="${REPO_ROOT:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
-cd "$REPO_ROOT"
-
-WORKFLOWS_DIR=".github/workflows"
-fail_count=0
-checked_count=0
-
-if [[ ! -d "$WORKFLOWS_DIR" ]]; then
-  echo "::error::workflows directory not found at $WORKFLOWS_DIR"
-  exit 1
-fi
-
-# Walk every .yml under .github/workflows/ and inspect each `uses:`
-# line whose target ends with `reusable-*.yml`.
-while IFS= read -r workflow; do
-  while IFS=: read -r line_no _; do
-    line=$(sed -n "${line_no}p" "$workflow")
-    # Extract the ref expression after `uses:`.
-    # Acceptable: <owner>/<repo>/.github/workflows/reusable-X.yml@<40-hex>
-    if echo "$line" | grep -qE '^\s*uses:\s*\./'; then
-      echo "::error file=$workflow,line=$line_no::reusable workflow referenced by relative path (mutable). Pin to <owner>/<repo>/.github/workflows/<file>@<40-hex-sha>."
-      echo "    $line"
-      fail_count=$((fail_count + 1))
-      continue
-    fi
-    if echo "$line" | grep -qE 'reusable-[a-z0-9-]+\.yml@[0-9a-f]{40}\b'; then
-      checked_count=$((checked_count + 1))
-      continue
-    fi
-    if echo "$line" | grep -qE 'reusable-[a-z0-9-]+\.yml@'; then
-      ref=$(echo "$line" | sed -E 's|.*reusable-[a-z0-9-]+\.yml@([^ #]+).*|\1|')
-      echo "::error file=$workflow,line=$line_no::reusable workflow pinned to mutable ref '$ref'. Pin to a 40-hex commit SHA instead."
-      echo "    $line"
-      fail_count=$((fail_count + 1))
-      continue
-    fi
-  done < <(grep -nE 'reusable-[a-z0-9-]+\.yml' "$workflow" || true)
-done < <(find "$WORKFLOWS_DIR" -maxdepth 1 -type f -name '*.yml')
-
-echo "reusable-pin lint: checked $checked_count call site(s), $fail_count failure(s)"
-
-if [[ "$fail_count" -gt 0 ]]; then
-  echo ""
-  echo "Refresh pinned SHAs with:"
-  echo "  git fetch origin master"
-  echo "  PIN=\$(git rev-parse origin/master)"
-  echo "  # Apply per call site, then verify:"
-  echo "  bash scripts/ci/lint-reusable-pins.sh"
-  echo ""
-  echo "Policy: docs/security/CI_PINNING.md"
-  exit 1
-fi
-
-exit 0