@sebastienrousseau/dotfiles 0.2.502 → 0.2.504

package/scripts/ci/validate-ci-config.sh

@@ -1,224 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# CI Configuration Validation Script
-# Verifies that all zero-warning policy components are properly configured
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(dirname "$(dirname "$SCRIPT_DIR")")"
-
-# Colors for output (respect NO_COLOR: https://no-color.org)
-if [[ -z "${NO_COLOR:-}" ]] && [[ -t 1 ]]; then
-  RED='\033[0;31m' GREEN='\033[0;32m' YELLOW='\033[0;33m'
-  BLUE='\033[0;34m' NC='\033[0m'
-else
-  RED='' GREEN='' YELLOW='' BLUE='' NC=''
-fi
-
-printf '%b\n' "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-printf '%b\n' "${BLUE}      CI CONFIGURATION VALIDATOR      ${NC}"
-printf '%b\n' "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-echo ""
-
-ERRORS=0
-WARNINGS=0
-
-# Helper functions
-check_file_exists() {
-  local file="$1"
-  local description="$2"
-
-  if [[ -f "$file" ]]; then
-    printf '%b\n' "  ${GREEN}✓${NC} $description"
-    return 0
-  else
-    printf '%b\n' "  ${RED}✗${NC} $description"
-    ((ERRORS++))
-    return 1
-  fi
-}
-
-check_pattern_in_file() {
-  local file="$1"
-  local pattern="$2"
-  local description="$3"
-
-  if [[ -f "$file" ]] && grep -q "$pattern" "$file"; then
-    printf '%b\n' "  ${GREEN}✓${NC} $description"
-    return 0
-  else
-    printf '%b\n' "  ${RED}✗${NC} $description"
-    ((ERRORS++))
-    return 1
-  fi
-}
-
-warn_if_pattern() {
-  local file="$1"
-  local pattern="$2"
-  local description="$3"
-
-  if [[ -f "$file" ]] && grep -q "$pattern" "$file"; then
-    printf '%b\n' "  ${YELLOW}⚠${NC} $description"
-    ((WARNINGS++))
-    return 1
-  else
-    printf '%b\n' "  ${GREEN}✓${NC} $description"
-    return 0
-  fi
-}
-
-# Check 1: Core CI files exist
-printf '%b\n' "${BLUE}1. Core CI Files${NC}"
-check_file_exists "$REPO_ROOT/.github/workflows/ci.yml" "Main CI workflow exists"
-check_file_exists "$REPO_ROOT/.github/workflows/nightly.yml" "Nightly workflow exists"
-check_file_exists "$REPO_ROOT/.github/workflows/security-enhanced.yml" "Security workflow exists"
-check_file_exists "$REPO_ROOT/config/pre-commit-config.yaml" "Pre-commit configuration exists"
-echo ""
-
-# Check 2: Zero-warning enforcement
-printf '%b\n' "${BLUE}2. Zero-Warning Policy Enforcement${NC}"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "zero-warning" "Zero-warning policy documented"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "fail on unformatted code" "Formatter failure enforced"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "warnings-as-errors" "Warnings treated as errors"
-
-# Verify no || true patterns in security steps
-warn_if_pattern "$REPO_ROOT/.github/workflows/ci.yml" "gitleaks.*||.*true" "Gitleaks bypass detected"
-warn_if_pattern "$REPO_ROOT/.github/workflows/ci.yml" "shellcheck.*||.*true" "Shellcheck bypass detected"
-echo ""
-
-# Check 3: Test coverage requirements
-printf '%b\n' "${BLUE}3. Test Coverage Requirements${NC}"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "100%" "100% coverage requirement"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "fail-under" "Coverage threshold enforcement"
-
-if [[ -f "$REPO_ROOT/tests/framework/test_runner.sh" ]]; then
-  printf '%b\n' "  ${GREEN}✓${NC} Test framework exists"
-else
-  printf '%b\n' "  ${RED}✗${NC} Test framework missing"
-  ((ERRORS++))
-fi
-echo ""
-
-# Check 4: Security scanning
-printf '%b\n' "${BLUE}4. Security Scanning Configuration${NC}"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "security-secrets" "Secret scanning enabled"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "security-dependencies" "Dependency audit enabled"
-check_pattern_in_file "$REPO_ROOT/config/pre-commit-config.yaml" "gitleaks" "Pre-commit secret scanning"
-check_pattern_in_file "$REPO_ROOT/config/pre-commit-config.yaml" "detect-secrets" "Advanced secret detection"
-
-# Verify no piped execution patterns
-warn_if_pattern "$REPO_ROOT/.github/workflows/ci.yml" "curl.*|.*sh" "Dangerous piped execution"
-warn_if_pattern "$REPO_ROOT/.github/workflows/ci.yml" "wget.*|.*bash" "Dangerous piped execution"
-echo ""
-
-# Check 5: Performance monitoring
-printf '%b\n' "${BLUE}5. Performance Monitoring${NC}"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "benchmark" "Performance benchmarking enabled"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "500ms" "Shell startup threshold defined"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/nightly.yml" "performance-tracking" "Nightly performance tracking"
-echo ""
-
-# Check 6: Multi-OS support
-printf '%b\n' "${BLUE}6. Multi-OS Testing${NC}"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "ubuntu-latest" "Linux testing enabled"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "macos-latest" "macOS testing enabled"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/nightly.yml" "matrix:" "OS matrix testing configured"
-echo ""
-
-# Check 7: Timeouts and efficiency
-printf '%b\n' "${BLUE}7. Timeout and Efficiency Settings${NC}"
-if grep -q "timeout-minutes: [0-9]" "$REPO_ROOT/.github/workflows/ci.yml"; then
-  MAX_TIMEOUT=$(grep "timeout-minutes:" "$REPO_ROOT/.github/workflows/ci.yml" |
-    awk '{print $2}' | sort -n | tail -1)
-  if [[ $MAX_TIMEOUT -le 15 ]]; then
-    printf '%b\n' "  ${GREEN}✓${NC} Job timeouts properly configured (max: ${MAX_TIMEOUT}min)"
-  else
-    printf '%b\n' "  ${YELLOW}⚠${NC} Some jobs have long timeouts (max: ${MAX_TIMEOUT}min)"
-    ((WARNINGS++))
-  fi
-else
-  printf '%b\n' "  ${RED}✗${NC} No timeout configuration found"
-  ((ERRORS++))
-fi
-
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "cache" "Dependency caching enabled"
-echo ""
-
-# Check 8: Branch protection readiness
-printf '%b\n' "${BLUE}8. Branch Protection Readiness${NC}"
-check_file_exists "$REPO_ROOT/.github/BRANCH_PROTECTION.md" "Branch protection documentation"
-check_pattern_in_file "$REPO_ROOT/.github/workflows/ci.yml" "quality-gate" "Quality gate job defined"
-
-# Check for required status check names
-REQUIRED_CHECKS=(
-  "lint-shell"
-  "security-secrets"
-  "security-dependencies"
-  "test-unit"
-  "quality-gate"
-)
-
-for check in "${REQUIRED_CHECKS[@]}"; do
-  if grep -q "name:.*$check" "$REPO_ROOT/.github/workflows/ci.yml"; then
-    printf '%b\n' "  ${GREEN}✓${NC} Required check '$check' defined"
-  else
-    printf '%b\n' "  ${RED}✗${NC} Required check '$check' missing"
-    ((ERRORS++))
-  fi
-done
-echo ""
-
-# Check 9: Nightly extended testing
-printf '%b\n' "${BLUE}9. Nightly Extended Testing${NC}"
-if [[ -f "$REPO_ROOT/.github/workflows/nightly.yml" ]]; then
-  check_pattern_in_file "$REPO_ROOT/.github/workflows/nightly.yml" "dependency-updates" "Dependency monitoring"
-  check_pattern_in_file "$REPO_ROOT/.github/workflows/nightly.yml" "beta-tools-test" "Beta tool testing"
-  check_pattern_in_file "$REPO_ROOT/.github/workflows/nightly.yml" "security-extended" "Extended security scanning"
-  check_pattern_in_file "$REPO_ROOT/.github/workflows/nightly.yml" "cron:" "Scheduled execution"
-else
-  printf '%b\n' "  ${RED}✗${NC} Nightly workflow missing"
-  ((ERRORS++))
-fi
-echo ""
-
-# Final summary
-printf '%b\n' "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-printf '%b\n' "${BLUE}           VALIDATION SUMMARY         ${NC}"
-printf '%b\n' "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-
-if [[ $ERRORS -eq 0 ]] && [[ $WARNINGS -eq 0 ]]; then
-  printf '%b\n' "${GREEN}✅ PERFECT: CI configuration fully compliant${NC}"
-  echo "   - Zero-warning policy properly enforced"
-  echo "   - All security gates configured"
-  echo "   - Performance monitoring active"
-  echo "   - Ready for branch protection"
-elif [[ $ERRORS -eq 0 ]]; then
-  printf '%b\n' "${YELLOW}⚠️  GOOD: CI mostly compliant with $WARNINGS warning(s)${NC}"
-  echo "   - Core functionality working"
-  echo "   - Minor improvements recommended"
-else
-  printf '%b\n' "${RED}❌ ISSUES: CI configuration has $ERRORS error(s) and $WARNINGS warning(s)${NC}"
-  echo "   - Critical fixes required before deployment"
-fi
-
-echo ""
-echo "Configuration Details:"
-echo "  - Repository: $REPO_ROOT"
-echo "  - Main CI: .github/workflows/ci.yml"
-echo "  - Nightly: .github/workflows/nightly.yml"
-echo "  - Pre-commit: config/pre-commit-config.yaml"
-echo ""
-echo "Next Steps:"
-if [[ $ERRORS -gt 0 ]]; then
-  echo "  1. Fix critical errors listed above"
-  echo "  2. Re-run validation: $0"
-fi
-if [[ $WARNINGS -gt 0 ]]; then
-  echo "  3. Address warnings for optimal configuration"
-fi
-echo "  4. Configure branch protection rules per BRANCH_PROTECTION.md"
-echo "  5. Test CI pipeline with a small PR"
-
-exit $ERRORS

package/scripts/ci/windows-smoke-test.ps1

@@ -1,136 +0,0 @@
-<#
-.SYNOPSIS
-  Windows smoke test for the dotfiles framework.
-
-.DESCRIPTION
-  Ships under PowerShell 7.5+; verifies that the `dot` dispatcher
-  starts, that key read-only commands work, and that chezmoi can be
-  invoked from PowerShell. Designed to run inside `windows-latest`
-  GitHub Actions runners (B1 of ROADMAP_2026).
-
-  Closes the audit gap "PowerShell 7.5+ claim unverified."
-
-.NOTES
-  Exit codes:
-    0   all checks passed
-    1   one or more checks failed
-    2   environment misconfigured (chezmoi/dot missing)
-#>
-
-[CmdletBinding()]
-param(
-  [string] $RepoRoot = (Get-Location).Path,
-  [switch] $Strict
-)
-
-$ErrorActionPreference = 'Stop'
-Set-StrictMode -Version Latest
-
-$script:Failures = @()
-
-function Assert-Step {
-  param(
-    [Parameter(Mandatory)] [string] $Name,
-    [Parameter(Mandatory)] [scriptblock] $Test
-  )
-  Write-Host "→ $Name " -NoNewline
-  try {
-    & $Test | Out-Null
-    Write-Host 'ok' -ForegroundColor Green
-  }
-  catch {
-    Write-Host 'FAIL' -ForegroundColor Red
-    Write-Host "  $($_.Exception.Message)" -ForegroundColor DarkRed
-    $script:Failures += $Name
-  }
-}
-
-# ─── PowerShell version contract ─────────────────────────────────────────────
-# 7.4 is current LTS (EOL 2026-11-10); 7.5 is current stable. README claims
-# "PowerShell 7.5+" forward-looking; the 7.4 LTS window keeps this gate
-# at 7.4+ until the bundled runner version rolls forward.
-Assert-Step 'PowerShell >= 7.4 (LTS or current)' {
-  if ($PSVersionTable.PSVersion.Major -lt 7 -or
-      ($PSVersionTable.PSVersion.Major -eq 7 -and $PSVersionTable.PSVersion.Minor -lt 4)) {
-    throw "PowerShell $($PSVersionTable.PSVersion) — need 7.4+ (LTS) or 7.5+ (current)"
-  }
-}
-
-# ─── Repo layout sanity ──────────────────────────────────────────────────────
-Assert-Step 'dot dispatcher present' {
-  $dot = Join-Path $RepoRoot 'dot_local/bin/executable_dot'
-  if (-not (Test-Path $dot)) { throw "missing $dot" }
-}
-
-Assert-Step '.chezmoidata.toml present' {
-  $data = Join-Path $RepoRoot '.chezmoidata.toml'
-  if (-not (Test-Path $data)) { throw "missing $data" }
-}
-
-# ─── chezmoi callable from pwsh ──────────────────────────────────────────────
-Assert-Step 'chezmoi on PATH' {
-  $cmd = Get-Command chezmoi -ErrorAction SilentlyContinue
-  if (-not $cmd) { throw 'chezmoi not on PATH (install via scoop install chezmoi or winget)' }
-}
-
-Assert-Step 'chezmoi --version succeeds' {
-  $out = & chezmoi --version 2>&1
-  if ($LASTEXITCODE -ne 0) { throw "rc=$LASTEXITCODE :: $out" }
-}
-
-# ─── dot CLI cold-start (only when bash is on PATH) ──────────────────────────
-$bash = Get-Command bash -ErrorAction SilentlyContinue
-if ($bash) {
-  Assert-Step 'dot version' {
-    $dot = Join-Path $RepoRoot 'dot_local/bin/executable_dot'
-    $out = & bash $dot 'version' 2>&1
-    if ($LASTEXITCODE -ne 0) { throw "rc=$LASTEXITCODE :: $out" }
-  }
-  Assert-Step 'dot help' {
-    $dot = Join-Path $RepoRoot 'dot_local/bin/executable_dot'
-    $out = & bash $dot 'help' 2>&1
-    if ($LASTEXITCODE -ne 0) { throw "rc=$LASTEXITCODE :: $out" }
-  }
-  Assert-Step 'dot agents check (AGENTS.md ↔ CLAUDE.md sync)' {
-    # `Push-Location` so the bash subprocess's $PWD points at the
-    # repo root — the bash dispatcher uses `git rev-parse` against
-    # $PWD when no usable chezmoi source-path is on disk.
-    Push-Location $RepoRoot
-    try {
-      $dot = Join-Path $RepoRoot 'dot_local/bin/executable_dot'
-      $out = & bash $dot 'agents' 'check' 2>&1
-      if ($LASTEXITCODE -ne 0) { throw "rc=$LASTEXITCODE :: $out" }
-    }
-    finally {
-      Pop-Location
-    }
-  }
-}
-else {
-  Write-Host '→ skipping bash-dependent checks (no bash on PATH)' -ForegroundColor DarkYellow
-}
-
-# ─── PSScriptAnalyzer over the smoke-test itself ────────────────────────────
-Assert-Step 'PSScriptAnalyzer over scripts/ci/*.ps1' {
-  if (-not (Get-Module -ListAvailable -Name PSScriptAnalyzer)) {
-    Install-Module PSScriptAnalyzer -Force -Scope CurrentUser -ErrorAction Stop
-  }
-  # `@(...)` so a single-result return value is still an array, otherwise
-  # `.Count` on a $null / scalar trips the strict-mode property check.
-  $issues = @(Invoke-ScriptAnalyzer -Path (Join-Path $RepoRoot 'scripts/ci') -Severity Error -ErrorAction Stop)
-  if ($issues.Count -gt 0) {
-    $msg = ($issues | ForEach-Object { "$($_.RuleName) at $($_.ScriptPath):$($_.Line)" }) -join '; '
-    throw "PSScriptAnalyzer found $($issues.Count) error(s): $msg"
-  }
-}
-
-# ─── Summary ─────────────────────────────────────────────────────────────────
-if ($script:Failures.Count -gt 0) {
-  Write-Host ''
-  Write-Host "FAILED: $($script:Failures -join ', ')" -ForegroundColor Red
-  exit 1
-}
-
-Write-Host ''
-Write-Host 'All Windows smoke checks passed.' -ForegroundColor Green
-exit 0