@sebastienrousseau/dotfiles 0.2.508 → 0.2.511

package/docs/security/AUDIT_BYPASS.md

@@ -5,7 +5,7 @@ render_with_liquid: false
 # Pre-Push Audit Bypass
 
 This page documents when the pre-push reliability audit can be bypassed,
-how to do it, and why the answer is "almost never on `master`."
+how to do it, and why the answer is "almost never on `main`."
 
 ## Background
 
@@ -57,7 +57,7 @@ bypassed?" without git archaeology.
 
 Short list — anything outside this is suspicious:
 
-- **Hotfix push to a non-master branch** when CI infrastructure itself
+- **Hotfix push to a non-main branch** when CI infrastructure itself
   is the audit blocker (e.g., the audit pre-flight depends on a remote
   service that's down). The fix should land *before* the
   infrastructure recovers; bypass is the bridge.
@@ -66,7 +66,7 @@ Short list — anything outside this is suspicious:
 
 When bypass is **not** legitimate:
 
-- Routine `master` pushes. The whole point of the audit is to guard
+- Routine `main` pushes. The whole point of the audit is to guard
   the protected branch.
 - Pushes whose audit failure is "annoying" — the right move is to fix
   the failure, not skip the check.

package/docs/security/AUTOMATION_SECRETS.md

@@ -21,6 +21,6 @@ render_with_liquid: false
 ## Provisioning notes
 
 1. Store the SSH signing private key in GitHub Actions as `ACTIONS_BOT_SIGNING_KEY`.
-2. Store the matching public key in [allowed_signers](../../defaults/dot_config/git/allowed_signers.tmpl).
+2. Store the matching public key in [allowed_signers](https://github.com/sebastienrousseau/dotfiles/blob/main/defaults/dot_config/git/allowed_signers.tmpl).
 3. Rotate the key on personnel or workstation change.
 4. Fail closed when secrets are absent.

package/docs/security/CI_PINNING.md

@@ -17,7 +17,7 @@ Every external dependency the CI pipeline consumes must be pinned by
 When `ci.yml` calls a reusable via `./.github/workflows/reusable-X.yml`,
 GitHub resolves the reusable from the **same ref as the calling
 workflow at run time**. For an in-repo PR that's the PR's branch —
-fine. The risk is the inverse: a malicious push to `master` (or any
+fine. The risk is the inverse: a malicious push to `main` (or any
 ref the calling workflow might resolve from) can swap reusable
 content under a CI run, with no audit trail in the PR diff.
 
@@ -29,11 +29,11 @@ site — visible in the PR diff, reviewable, revertible.
 
 ```yaml
 # Acceptable — full SHA pin.
-uses: sebastienrousseau/dotfiles/.github/workflows/reusable-shell-lint.yml@b0615f8fb5c0f3826f58904a5567eff11b6c500e # master
+uses: sebastienrousseau/dotfiles/.github/workflows/reusable-shell-lint.yml@b0615f8fb5c0f3826f58904a5567eff11b6c500e # main
 ```
 
 The trailing comment is a human-readable hint at what the SHA
-represented when it was pinned (typically `master`, sometimes a tag
+represented when it was pinned (typically `main`, sometimes a tag
 like `v0.2.501`). The hint is documentation only — the SHA is what
 GitHub uses.
 
@@ -44,7 +44,7 @@ GitHub uses.
 uses: ./.github/workflows/reusable-shell-lint.yml
 
 # Rejected — branch ref is mutable.
-uses: sebastienrousseau/dotfiles/.github/workflows/reusable-shell-lint.yml@master
+uses: sebastienrousseau/dotfiles/.github/workflows/reusable-shell-lint.yml@main
 
 # Rejected — tag ref is mutable (tags can be moved).
 uses: sebastienrousseau/dotfiles/.github/workflows/reusable-shell-lint.yml@v0.2.501
@@ -57,20 +57,20 @@ rejected forms above.
 ## Refreshing pinned SHAs
 
 `bump-reusable-pins.yml` handles this automatically. On every push to
-`master` that touches `.github/workflows/reusable-*.yml`, the bot scans
+`main` that touches `.github/workflows/reusable-*.yml`, the bot scans
 caller workflows for stale pins and opens a PR bumping them to the new
 SHA. Signed with `ACTIONS_BOT_SIGNING_KEY` so the resulting commit
 passes `Verify Commit Signatures`.
 
 The manual recipe below stays here as a fallback — for example, if you
-need to bump pins before a merge to master, or if the bot's run failed
+need to bump pins before a merge to main, or if the bot's run failed
 and you want to short-circuit waiting for the next push trigger.
 
 ```sh
-# 1. Land the change to the reusable on master via a PR.
-# 2. After merge, capture the new master SHA:
-git fetch origin master
-PIN=$(git rev-parse origin/master)
+# 1. Land the change to the reusable on main via a PR.
+# 2. After merge, capture the new main SHA:
+git fetch origin main
+PIN=$(git rev-parse origin/main)
 echo "$PIN"
 
 # 3. Bump every call site:

package/docs/security/COMMIT_SIGNING.md

@@ -1,6 +1,6 @@
 # Commit Signing — Policy & Setup
 
-Every commit that reaches `master` in this repository must carry a
+Every commit that reaches `main` in this repository must carry a
 cryptographic signature that GitHub can verify. The policy is enforced
 in three independent layers, so a single bypass does not break the
 chain. This document explains the policy, walks through SSH and GPG
@@ -24,16 +24,16 @@ is missing. The chain below removes every escape hatch.
    `git verify-commit` against every commit in the push range. A
    single unverified commit aborts the push. `--no-verify` skips
    this layer; the next two catch it.
-3. **GitHub Rulesets** — `.github/rulesets/master.json` declares
-   `required_signatures` on `refs/heads/master`. The rule is part
+3. **GitHub Rulesets** — `.github/rulesets/main.json` declares
+   `required_signatures` on `refs/heads/main`. The rule is part
    of the repo so it's reproducible across forks. Apply with
-   `gh ruleset import .github/rulesets/master.json`.
+   `gh ruleset import .github/rulesets/main.json`.
 4. **`compliance-guard.yml` workflow** — runs on every PR targeting
-   `master`. Walks the commit range with `git verify-commit` and
+   `main`. Walks the commit range with `git verify-commit` and
    marks unsigned commits in the PR summary; fails the workflow
    when `unsigned_count > 0`.
 
-A merge to `master` therefore requires (Ruleset accepts the push) AND
+A merge to `main` therefore requires (Ruleset accepts the push) AND
 (the workflow's signed-commit check passes) AND (the maintainer's
 push key is allowed). The protection holds even if a contributor's
 local hooks are missing or skipped.
@@ -100,7 +100,7 @@ git log "$(git merge-base @{u} HEAD)..HEAD" \
 for c in $(git rev-list "$(git merge-base @{u} HEAD)..HEAD"); do
   git verify-commit "$c" >/dev/null 2>&1 \
     && echo "✓ $c" \
-    || echo "✗ $c — unsigned, will be rejected by master ruleset"
+    || echo "✗ $c — unsigned, will be rejected by main ruleset"
 done
 ```
 
@@ -112,7 +112,7 @@ done
 | `error: Load key "/.../id_ed25519": Permission denied` | SSH key permissions too open | `chmod 600 ~/.ssh/id_ed25519` |
 | GitHub shows "Unverified" on a commit signed locally | Signing key not uploaded to GitHub | `gh ssh-key add … --type signing` (SSH) or `gh gpg-key add` (GPG) |
 | Pre-push hook rejects a merge commit you didn't author | Upstream commit lacks a signature | Either pull the rebased branch, or fast-forward instead of merging |
-| Ruleset import via `gh` complains "invalid JSON" | Rulesets API expects the `target` + `rules` envelope, not just the rules array | Use the file as-is — `gh ruleset import .github/rulesets/master.json` |
+| Ruleset import via `gh` complains "invalid JSON" | Rulesets API expects the `target` + `rules` envelope, not just the rules array | Use the file as-is — `gh ruleset import .github/rulesets/main.json` |
 
 ## Re-applying the ruleset after a manual edit
 
@@ -121,14 +121,14 @@ file-of-truth wins. Re-apply:
 
 ```sh
 gh api -X POST repos/{owner}/{repo}/rulesets \
-  --input .github/rulesets/master.json
+  --input .github/rulesets/main.json
 ```
 
 (or `-X PUT` against the existing ruleset's ID if it already exists).
 
 ## References
 
-- `.github/rulesets/master.json` — the enforced policy.
+- `.github/rulesets/main.json` — the enforced policy.
 - `.github/workflows/compliance-guard.yml` — the workflow that
   fails PRs containing unsigned commits.
 - `scripts/git-hooks/pre-push` — the local pre-push gate.

package/docs/security/DEPS_DEV_EXCEPTIONS.md

@@ -7,7 +7,7 @@ render_with_liquid: false
 The CI workflow `.github/workflows/deps-dev-validation.yml` scans
 direct dependencies (npm + PyPI + GitHub Actions) against the
 [deps.dev Insights API](https://docs.deps.dev/) on every PR, every
-push to `master`, and every Tuesday at 04:00 UTC. When an advisory
+push to `main`, and every Tuesday at 04:00 UTC. When an advisory
 is reported at or above the threshold (default `HIGH`), the workflow
 fails.
 
@@ -79,8 +79,8 @@ auto-fail the gate even when they're still listed here.
 
 ## References
 
-- [`tools/ci/check-deps-dev.sh`](../../tools/ci/check-deps-dev.sh) — the scanner.
-- [`.github/workflows/deps-dev-validation.yml`](../../.github/workflows/deps-dev-validation.yml) — CI wiring.
-- [`tests/unit/security/test_check_deps_dev.sh`](../../tests/unit/security/test_check_deps_dev.sh) — contract test against canned fixtures.
+- [`tools/ci/check-deps-dev.sh`](https://github.com/sebastienrousseau/dotfiles/blob/main/tools/ci/check-deps-dev.sh) — the scanner.
+- [`.github/workflows/deps-dev-validation.yml`](https://github.com/sebastienrousseau/dotfiles/blob/main/.github/workflows/deps-dev-validation.yml) — CI wiring.
+- [`tests/unit/security/test_check_deps_dev.sh`](https://github.com/sebastienrousseau/dotfiles/blob/main/tests/unit/security/test_check_deps_dev.sh) — contract test against canned fixtures.
 - [deps.dev API reference](https://docs.deps.dev/api/v3/).
 - Issue [#877](https://github.com/sebastienrousseau/dotfiles/issues/877).

package/docs/security/DISCLOSURE.md

@@ -34,7 +34,7 @@ gpg --fingerprint security@sebastienrousseau.com
 ```
 
 The fingerprint must match the one published in
-[`.github/SECURITY.md`](../../.github/SECURITY.md). Cross-verify
+[`.github/SECURITY.md`](https://github.com/sebastienrousseau/dotfiles/blob/main/.github/SECURITY.md). Cross-verify
 against the SSH signing key in `dot_config/git/allowed_signers.tmpl`
 — the maintainer signs commits with the same identity, so both
 fingerprints derive from the same identity claim.
@@ -75,7 +75,7 @@ subjects in plain text).
 ## 5. Acknowledgement
 
 You should receive an acknowledgement within the SLA in
-[`.github/SECURITY.md`](../../.github/SECURITY.md):
+[`.github/SECURITY.md`](https://github.com/sebastienrousseau/dotfiles/blob/main/.github/SECURITY.md):
 
 | Severity | Initial response |
 |---|---|
@@ -122,7 +122,7 @@ The maintainer commits to:
 
 ## See also
 
-- [`.github/SECURITY.md`](../../.github/SECURITY.md) — policy
+- [`.github/SECURITY.md`](https://github.com/sebastienrousseau/dotfiles/blob/main/.github/SECURITY.md) — policy
   overview + fingerprint.
 - [`docs/security/KEY_ROTATION.md`](KEY_ROTATION.md) — schedule for
   when the disclosure key is rotated.

package/docs/security/INCIDENT_RESPONSE.md

@@ -113,7 +113,7 @@ lock-configs
 gh workflow disable <workflow-name>
 
 # Force-protect the main branch
-gh api repos/{owner}/{repo}/branches/master/protection \
+gh api repos/{owner}/{repo}/branches/main/protection \
   --method PUT \
   --field required_status_checks='{"strict":true,"contexts":["ci"]}' \
   --field enforce_admins=true

package/docs/security/INSTALL_VERIFICATION.md

@@ -56,7 +56,7 @@ These are weaker than a SHA256 check, but they catch the obvious
 After chezmoi is installed, `install.sh` clones the dotfiles repo
 itself. This isn't currently cryptographically verified beyond Git's
 own object integrity, but commits in the repo are SSH-signed and
-branch protection on `master` requires signed commits (see #853).
+branch protection on `main` requires signed commits (see #853).
 
 ## How to obtain per-release hashes
 
@@ -64,7 +64,7 @@ The verified-install snippet uses the SHA256 of the `install.sh`
 file *as it exists at the release tag*. To regenerate after a release:
 
 ```bash
-git switch master
+git switch main
 git pull
 NEW_TAG="v0.2.502"   # adjust
 git tag -s "$NEW_TAG" -m "..."

package/docs/security/MCP_POLICY.md

@@ -21,9 +21,9 @@ Properties:
 
 ## Policy artifact
 
-The source of truth lives in [mcp-policy.json](../../defaults/dot_config/dotfiles/mcp-policy.json).
-Approved package pins live in [mcp-lock.json](../../defaults/dot_config/dotfiles/mcp-lock.json).
-Tracked server registry entries live in [mcp-registry.json](../../defaults/dot_config/dotfiles/mcp-registry.json).
+The source of truth lives in [mcp-policy.json](https://github.com/sebastienrousseau/dotfiles/blob/main/defaults/dot_config/dotfiles/mcp-policy.json).
+Approved package pins live in [mcp-lock.json](https://github.com/sebastienrousseau/dotfiles/blob/main/defaults/dot_config/dotfiles/mcp-lock.json).
+Tracked server registry entries live in [mcp-registry.json](https://github.com/sebastienrousseau/dotfiles/blob/main/defaults/dot_config/dotfiles/mcp-registry.json).
 
 Current defaults:
 
@@ -75,4 +75,4 @@ Current approved refs:
 - active servers match the tracked registry entries
 - remote HTTP transports are HTTPS and OAuth-backed
 
-Policy bundle baselines live in [policy-bundles.json](../../defaults/dot_config/dotfiles/policy-bundles.json).
+Policy bundle baselines live in [policy-bundles.json](https://github.com/sebastienrousseau/dotfiles/blob/main/defaults/dot_config/dotfiles/policy-bundles.json).

package/docs/security/SCORECARD.md

@@ -41,7 +41,7 @@ Aggregate score **7.6 / 10** at 2026-05-17T08:11:51Z.
 [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/sebastienrousseau/dotfiles/badge)](https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/dotfiles)
 
 The badge above is regenerated every Monday at 06:00 UTC and on every
-push to `master` by `.github/workflows/scorecard.yml`. The SARIF
+push to `main` by `.github/workflows/scorecard.yml`. The SARIF
 result is uploaded to GitHub Code Scanning (Security tab) and
 retained as a 30-day workflow artifact.
 
@@ -57,7 +57,7 @@ Regressions are triaged within one Monday cycle: identify the check
 that dropped, either remediate or file an exception entry below with
 a rationale and an expiry date.
 
-## Per-check posture (snapshot, master HEAD)
+## Per-check posture (snapshot, main HEAD)
 
 The checks below come from OpenSSF Scorecard's published rubric. Tick
 marks reflect this repo's posture at the time of writing — the
@@ -65,19 +65,19 @@ marks reflect this repo's posture at the time of writing — the
 
 | Check | Status | Notes |
 |---|---|---|
-| Branch-Protection | ⚠ | `master` requires signed commits, linear history, required checks (`.github/rulesets/master.json`). Scorecard can't read classic protection rules without a fine-grained PAT, so this check reports as `-1` ("internal error"). |
+| Branch-Protection | ⚠ | `main` requires signed commits, linear history, required checks (`.github/rulesets/main.json`). Scorecard can't read classic protection rules without a fine-grained PAT, so this check reports as `-1` ("internal error"). |
 | Code-Review | ⚠ | Single-maintainer repo; PRs are self-merged after CI. Scorecard scores 0/30 here by design — see `Open findings` below. |
 | Signed-Commits | ✓ | Enforced by pre-push hook (`scripts/git-hooks/pre-push`) and at-push by branch protection (#853 + #857). |
 | Dependency-Update-Tool | ✓ | Dependabot configured for github-actions / npm / docker / devcontainers / uv. |
 | Fuzzing | ⚠ | `install.sh` fuzz harness lives under `tests/fuzz/` (closes #881), but it's shell-based and Scorecard's heuristic only recognizes OSS-Fuzz / ClusterFuzzLite / native Go fuzz / libFuzzer / Atheris. None support shell. Property tests under `tests/unit/functions/test_property_*.sh` cover the closest equivalent surface. |
 | License | ✓ | MIT at repo root (`LICENSE`). |
-| Maintained | ✓ | Active commit cadence; the [README](../../README.md) lists the current `dotfiles_version`. |
+| Maintained | ✓ | Active commit cadence; the [README](https://github.com/sebastienrousseau/dotfiles/blob/main/README.md) lists the current `dotfiles_version`. |
 | Pinned-Dependencies | ⚠ | Closed 8 of 14 findings this cycle (every Dockerfile base + every workflow action + 2 `curl \| sh` installers + the `npm install -g npm` upgrade step). 5 residual findings stay open by design — see `Open findings`. |
 | SAST | ✓ | CodeQL (`.github/workflows/codeql.yml`) + Checkov + Grype. |
 | SBOM | ✓ | Generated per PR by `sbom-diff.yml` and per release by `security-release.yml`. |
 | Security-Policy | ✓ | `.github/SECURITY.md` + this page + `docs/security/THREAT_MODEL.md`. |
 | Token-Permissions | ✓ | Top-level `permissions:` blocks restricted to `contents: read`. `write` scopes scoped to the jobs that need them (#886). |
-| Vulnerabilities | ✓ | Grype gate hard-fails on `high` / `critical` on `master` (#852). |
+| Vulnerabilities | ✓ | Grype gate hard-fails on `high` / `critical` on `main` (#852). |
 | Webhooks | n/a | No external webhooks configured. |
 | CI-Tests | ✓ | Linux + macOS Intel + Apple Silicon matrix; optional Windows. |
 | CII-Best-Practices | ☐ | Not applied yet — see `Open work` below. |
@@ -138,7 +138,7 @@ false positives in Scorecard's regex.
 - **Re-trigger Scorecard after SLSA backfill propagates** — expected `Signed-Releases` 3 → 10.
 - **`harden-runner` block-mode adoption (#878)** — should tighten the `Token-Permissions` check further.
 - **Investigate `License` 9/10 false-positive** — repo is MIT (SPDX-compliant), Scorecard's penalty should not apply.
-- **Investigate `Branch-Protection` `-1`** — scanner internal error; manually verify with `gh api repos/:owner/:repo/branches/master/protection` and document.
+- **Investigate `Branch-Protection` `-1`** — scanner internal error; manually verify with `gh api repos/:owner/:repo/branches/main/protection` and document.
 
 ### Enabling Branch-Protection + Webhooks checks (one-time PAT setup)
 
@@ -180,7 +180,7 @@ gh api 'repos/sebastienrousseau/dotfiles/code-scanning/alerts?state=open&per_pag
   --jq '[.[].rule.id] | group_by(.) | map({rule: .[0], count: length})'
 
 # Trigger Scorecard manually:
-gh workflow run scorecard.yml --ref master
+gh workflow run scorecard.yml --ref main
 ```
 
 If a new category appears, add a row to the matching bucket. If a

package/docs/security/SECURITY_CHECKLIST.md

@@ -45,7 +45,7 @@ Run `dot mcp --strict --json` to validate all MCP server configurations and capt
 - [ ] **SBOM Generation**: Verify `dotfiles-sbom.spdx.json` is generated in release workflow.
 - [ ] **Attestation Signing**: Confirm `actions/attest-build-provenance` signs the release artifacts.
 - [ ] **Attestation Verification**: Verify with `gh attestation verify <artifact> --repo sebastienrousseau/dotfiles`.
-- [ ] **Branch Protection**: Ensure `security-attestation` is a required status check on master.
+- [ ] **Branch Protection**: Ensure `security-attestation` is a required status check on main.
 - [ ] **Automation Keying**: Confirm `ACTIONS_BOT_SIGNING_KEY` exists and matches the signer in `dot_config/git/allowed_signers`.
 
 ## 7. Final Verification

package/docs/security/SHELL_EXEMPTIONS.md

@@ -7,10 +7,10 @@ render_with_liquid: false
 Every bash script in this repo must include `set -euo pipefail` (or
 `set -eu` for POSIX `sh`) within its first 50 lines. The rule is
 enforced by
-[`tools/ci/check-shell-preamble.sh`](../../tools/ci/check-shell-preamble.sh),
+[`tools/ci/check-shell-preamble.sh`](https://github.com/sebastienrousseau/dotfiles/blob/main/tools/ci/check-shell-preamble.sh),
 wired into `pre-commit` and the `reusable-shell-lint.yml` CI job.
 Tests pin the contract under
-[`tests/unit/security/test_shell_preamble_lint.sh`](../../tests/unit/security/test_shell_preamble_lint.sh).
+[`tests/unit/security/test_shell_preamble_lint.sh`](https://github.com/sebastienrousseau/dotfiles/blob/main/tests/unit/security/test_shell_preamble_lint.sh).
 
 ## Why the preamble is mandatory
 

package/docs/security/SOUP_REGISTER.md

@@ -12,13 +12,13 @@ Controlled inventory for software of unknown pedigree used by the dotfiles platf
 
 | Component | Source | Version control | Verification path | Owner | Status |
 | :--- | :--- | :--- | :--- | :--- | :--- |
-| Homebrew installer | `raw.githubusercontent.com/Homebrew/install` | Moving upstream script, gated by `HOMEBREW_INSTALLER_SHA256` | SHA-256 in [package_managers.sh](../../install/lib/package_managers.sh) | Repo maintainer | Conditional |
+| Homebrew installer | `raw.githubusercontent.com/Homebrew/install` | Moving upstream script, gated by `HOMEBREW_INSTALLER_SHA256` | SHA-256 in [package_managers.sh](https://github.com/sebastienrousseau/dotfiles/blob/main/install/lib/package_managers.sh) | Repo maintainer | Conditional |
 | Chezmoi installer | `get.chezmoi.io` | Pinned by `CHEZMOI_INSTALLER_SHA256` when used | SHA-256 in `install/lib/chezmoi.sh` | Repo maintainer | Controlled |
 | GitHub Actions marketplace actions | GitHub Marketplace | Full commit SHA pinning | Workflow `uses:` pins | Repo maintainer | Controlled |
-| Grype container | `anchore/grype` | Pinned tag in workflow | Container tag in [security-enhanced.yml](../../.github/workflows/security-enhanced.yml) | Repo maintainer | Controlled |
-| Trivy container | `aquasec/trivy` | Pinned tag in workflow | Container tag in [security-enhanced.yml](../../.github/workflows/security-enhanced.yml) | Repo maintainer | Controlled |
+| Grype container | `anchore/grype` | Pinned tag in workflow | Container tag in [security-enhanced.yml](https://github.com/sebastienrousseau/dotfiles/blob/main/.github/workflows/security-enhanced.yml) | Repo maintainer | Controlled |
+| Trivy container | `aquasec/trivy` | Pinned tag in workflow | Container tag in [security-enhanced.yml](https://github.com/sebastienrousseau/dotfiles/blob/main/.github/workflows/security-enhanced.yml) | Repo maintainer | Controlled |
 | Checkov action | GitHub Marketplace | Full commit SHA pinning | Workflow `uses:` pin | Repo maintainer | Controlled |
-| Nix inputs | GitHub flakes | Locked in [flake.lock](../../flake.lock) | `narHash` and revision lock | Repo maintainer | Controlled |
+| Nix inputs | GitHub flakes | Locked in [flake.lock](https://github.com/sebastienrousseau/dotfiles/blob/main/flake.lock) | `narHash` and revision lock | Repo maintainer | Controlled |
 | GitHub release metadata queries | GitHub API | Discovery only, not release validation | `update-deps.yml` query path | Repo maintainer | Monitored |
 
 ## Validation record