@sebastienrousseau/dotfiles 0.2.508 → 0.2.511
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +42 -0
- package/README.md +5 -5
- package/docs/COPYRIGHT +1 -1
- package/docs/GOVERNANCE.md +2 -2
- package/docs/adr/ADR-011-nushell-tier3-keep.md +2 -2
- package/docs/articles/.pages +6 -0
- package/docs/articles/2026-07-05-custom-mkdocs-material-dark-theme.md +216 -0
- package/docs/articles/2026-07-05-fish-startup-abbr.md +153 -0
- package/docs/articles/2026-07-05-master-to-main-rename-runbook.md +128 -0
- package/docs/articles/index.md +36 -0
- package/docs/guides/INSTALL.md +3 -3
- package/docs/index.md +116 -27
- package/docs/interop/A2A.md +2 -2
- package/docs/interop/POWERSHELL.md +4 -4
- package/docs/manual/00-introduction.md +3 -3
- package/docs/manual/01-concepts/02-trust-model.md +3 -3
- package/docs/manual/01-concepts/04-fleet.md +1 -1
- package/docs/manual/02-tutorials/01-first-install.md +1 -1
- package/docs/manual/02-tutorials/05-deploy-fleet.md +2 -2
- package/docs/manual/03-reference/02-config-files.md +1 -1
- package/docs/manual/03-reference/04-templates.md +1 -1
- package/docs/manual/04-cookbook/01-recipes.md +1 -1
- package/docs/manual/04-cookbook/02-troubleshooting.md +1 -1
- package/docs/manual/05-appendices/B-security-checklist.md +1 -1
- package/docs/manual/command-index.md +76 -1
- package/docs/manual/index.md +1 -1
- package/docs/operations/ARCHITECTURE_ROADMAP.md +145 -0
- package/docs/operations/CI_CADENCE.md +2 -2
- package/docs/operations/COMPLETIONS.md +2 -2
- package/docs/operations/COVERAGE.md +4 -4
- package/docs/operations/DRIFT.md +1 -1
- package/docs/operations/MAINTENANCE.md +6 -6
- package/docs/operations/PERFORMANCE.md +6 -6
- package/docs/operations/RELIABILITY.md +1 -1
- package/docs/operations/ROADMAP_V0_2_503.md +1 -1
- package/docs/operations/TRACEABILITY.md +2 -0
- package/docs/operations/TRUSTED_AGENT_WORKSTATION.md +6 -6
- package/docs/operations/VERSION_SYNC.md +3 -3
- package/docs/reference/UTILS.md +82 -0
- package/docs/security/AUDIT_BYPASS.md +3 -3
- package/docs/security/AUTOMATION_SECRETS.md +1 -1
- package/docs/security/CI_PINNING.md +10 -10
- package/docs/security/COMMIT_SIGNING.md +10 -10
- package/docs/security/DEPS_DEV_EXCEPTIONS.md +4 -4
- package/docs/security/DISCLOSURE.md +3 -3
- package/docs/security/INCIDENT_RESPONSE.md +1 -1
- package/docs/security/INSTALL_VERIFICATION.md +2 -2
- package/docs/security/MCP_POLICY.md +4 -4
- package/docs/security/SCORECARD.md +7 -7
- package/docs/security/SECURITY_CHECKLIST.md +1 -1
- package/docs/security/SHELL_EXEMPTIONS.md +2 -2
- package/docs/security/SOUP_REGISTER.md +4 -4
- package/docs/stylesheets/extra.css +444 -0
- package/docs/themes/hero-shot.svg +1 -1
- package/install.sh +17 -6
- package/package.json +1 -1
- package/scripts/ci/check-copyright-headers.sh +1 -1
- package/scripts/ci/check-shell-preamble.sh +1 -1
- package/scripts/ci/guard-gitleaks-checkout.sh +1 -1
- package/scripts/diagnostics/aliases-manifest.sh +19 -1
- package/scripts/diagnostics/verify_state.sh +6 -2
- package/scripts/diagnostics/version-locks.sh +10 -6
- package/scripts/dot/commands/agent.sh +12 -7
- package/scripts/dot/commands/ai.sh +8 -5
- package/scripts/dot/commands/appearance.sh +14 -1
- package/scripts/dot/commands/completion.sh +134 -0
- package/scripts/dot/commands/core.sh +8 -0
- package/scripts/dot/commands/diagnostics.sh +16 -0
- package/scripts/dot/commands/fleet.sh +11 -4
- package/scripts/dot/commands/lint.sh +55 -30
- package/scripts/dot/commands/registry.sh +7 -1
- package/scripts/dot/commands/secrets.sh +61 -7
- package/scripts/dot/commands/security.sh +8 -0
- package/scripts/dot/commands/tools.sh +11 -2
- package/scripts/dot/powershell/Dot.psm1 +1 -1
- package/scripts/git-hooks/pre-commit-audit.sh +1 -1
- package/scripts/ops/heal-tools.sh +28 -0
- package/scripts/ops/teleport.sh +2 -2
- package/scripts/qa/examples-coverage.sh +94 -0
- package/scripts/tools/detect-collisions.py +19 -1
- package/scripts/version-sync.sh +36 -2
- package/docs/_config.yml +0 -59
|
@@ -0,0 +1,94 @@
|
|
|
1
|
+
#!/usr/bin/env bash
|
|
2
|
+
# SPDX-License-Identifier: MIT
|
|
3
|
+
# Copyright (c) 2015-2026 Sebastien Rousseau
|
|
4
|
+
# =============================================================================
|
|
5
|
+
# examples-coverage.sh — enforce that every core feature domain ships a
|
|
6
|
+
# runnable example under examples/. Mirrors scripts/qa/docs-coverage.sh:
|
|
7
|
+
# it is a *coverage contract*, not a linter. Threshold defaults to 100%.
|
|
8
|
+
#
|
|
9
|
+
# A feature domain is "covered" when examples/example-<domain>.sh exists.
|
|
10
|
+
# Keep REQUIRED_AREAS in lockstep with the feature surface — adding a major
|
|
11
|
+
# user-facing capability (a new `dot` subsystem) means adding its example.
|
|
12
|
+
# =============================================================================
|
|
13
|
+
set -euo pipefail
|
|
14
|
+
|
|
15
|
+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
16
|
+
REPO_ROOT="${REPO_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
|
|
17
|
+
EXAMPLES_DIR="$REPO_ROOT/examples"
|
|
18
|
+
DOT_CLI="$REPO_ROOT/bin/dot"
|
|
19
|
+
MIN_EXAMPLES_COVERAGE="${MIN_EXAMPLES_COVERAGE:-100}"
|
|
20
|
+
|
|
21
|
+
# Public commands/subcommands, extracted from bin/dot's _dot_help_specs — the
|
|
22
|
+
# same source scripts/qa/docs-coverage.sh uses, so docs and examples stay in
|
|
23
|
+
# lockstep at the command granularity.
|
|
24
|
+
extract_public_commands() {
|
|
25
|
+
awk -F'|' '
|
|
26
|
+
/_dot_help_specs\(\)/ { in_func=1; next }
|
|
27
|
+
in_func && /cat <<'\''EOF'\''/ { in_block=1; next }
|
|
28
|
+
in_block && /^EOF$/ { exit }
|
|
29
|
+
in_block && NF>=2 { print $2 }
|
|
30
|
+
' "$DOT_CLI"
|
|
31
|
+
}
|
|
32
|
+
|
|
33
|
+
# Core feature domains that must each have examples/example-<area>.sh.
|
|
34
|
+
REQUIRED_AREAS=(
|
|
35
|
+
ai-patterns
|
|
36
|
+
cli-utilities
|
|
37
|
+
coverage-gate
|
|
38
|
+
diagnostics
|
|
39
|
+
dot-commands
|
|
40
|
+
functions
|
|
41
|
+
fleet
|
|
42
|
+
git-hooks
|
|
43
|
+
install-uninstall
|
|
44
|
+
ops
|
|
45
|
+
platform-contract
|
|
46
|
+
qa
|
|
47
|
+
secrets
|
|
48
|
+
security
|
|
49
|
+
test-suite
|
|
50
|
+
testing-framework
|
|
51
|
+
theme
|
|
52
|
+
)
|
|
53
|
+
|
|
54
|
+
total=0
|
|
55
|
+
covered=0
|
|
56
|
+
missing=()
|
|
57
|
+
|
|
58
|
+
# --- Check 1: every feature domain has a dedicated example file. ---
|
|
59
|
+
for area in "${REQUIRED_AREAS[@]}"; do
|
|
60
|
+
total=$((total + 1))
|
|
61
|
+
if [ -f "$EXAMPLES_DIR/example-$area.sh" ]; then
|
|
62
|
+
covered=$((covered + 1))
|
|
63
|
+
else
|
|
64
|
+
missing+=("domain:$area")
|
|
65
|
+
fi
|
|
66
|
+
done
|
|
67
|
+
|
|
68
|
+
# --- Check 2: every public command/subcommand is referenced in an example. ---
|
|
69
|
+
while IFS= read -r cmd; do
|
|
70
|
+
[ -n "$cmd" ] || continue
|
|
71
|
+
total=$((total + 1))
|
|
72
|
+
# "dot <cmd>" followed by a non-identifier char (or EOL) — avoids matching
|
|
73
|
+
# `dot ai` against `dot ai-query`, and matches printf '...\n'-terminated refs.
|
|
74
|
+
if grep -rqE "dot ${cmd}([^A-Za-z0-9_-]|\$)" "$EXAMPLES_DIR" 2>/dev/null; then
|
|
75
|
+
covered=$((covered + 1))
|
|
76
|
+
else
|
|
77
|
+
missing+=("cmd:$cmd")
|
|
78
|
+
fi
|
|
79
|
+
done < <(extract_public_commands | sort -u)
|
|
80
|
+
|
|
81
|
+
pct="$(awk -v c="$covered" -v t="$total" \
|
|
82
|
+
'BEGIN{if(t==0){print "0.00"}else{printf "%.2f", (100*c/t)}}')"
|
|
83
|
+
printf 'Examples coverage: %s/%s (%s%%)\n' "$covered" "$total" "$pct"
|
|
84
|
+
printf 'Threshold: %s%%\n' "$MIN_EXAMPLES_COVERAGE"
|
|
85
|
+
if [ "${#missing[@]}" -gt 0 ]; then
|
|
86
|
+
printf 'Missing coverage for: %s\n' "${missing[*]}" >&2
|
|
87
|
+
fi
|
|
88
|
+
|
|
89
|
+
if awk -v p="$pct" -v min="$MIN_EXAMPLES_COVERAGE" 'BEGIN{exit !(p+0 >= min+0)}'; then
|
|
90
|
+
printf 'PASS: every feature domain and every public command has an example.\n'
|
|
91
|
+
exit 0
|
|
92
|
+
fi
|
|
93
|
+
printf 'FAIL: examples coverage %s%% is below the %s%% threshold.\n' "$pct" "$MIN_EXAMPLES_COVERAGE" >&2
|
|
94
|
+
exit 1
|
|
@@ -8,7 +8,25 @@ import os
|
|
|
8
8
|
import re
|
|
9
9
|
import sys
|
|
10
10
|
|
|
11
|
-
|
|
11
|
+
# Post-Phase-4b (v0.2.503): chezmoi source is under the subdir
|
|
12
|
+
# named in .chezmoiroot (typically "defaults/"). Prefer the
|
|
13
|
+
# descended path; fall back to the old top-level layout for
|
|
14
|
+
# backwards compatibility.
|
|
15
|
+
_DOTFILES_ROOT = os.path.expanduser("~/.dotfiles")
|
|
16
|
+
_CHEZMOIROOT_FILE = os.path.join(_DOTFILES_ROOT, ".chezmoiroot")
|
|
17
|
+
|
|
18
|
+
|
|
19
|
+
def _resolve_chezmoi_root() -> str:
|
|
20
|
+
if os.path.isfile(_CHEZMOIROOT_FILE):
|
|
21
|
+
with open(_CHEZMOIROOT_FILE, "r", encoding="utf-8") as _f:
|
|
22
|
+
sub = _f.read().strip()
|
|
23
|
+
cand = os.path.join(_DOTFILES_ROOT, sub)
|
|
24
|
+
if os.path.isdir(cand):
|
|
25
|
+
return cand
|
|
26
|
+
return _DOTFILES_ROOT
|
|
27
|
+
|
|
28
|
+
|
|
29
|
+
BASE_DIR = os.path.join(_resolve_chezmoi_root(), ".chezmoitemplates")
|
|
12
30
|
ALIASES_DIR = os.path.join(BASE_DIR, "aliases")
|
|
13
31
|
FUNCTIONS_DIR = os.path.join(BASE_DIR, "functions")
|
|
14
32
|
|
package/scripts/version-sync.sh
CHANGED
|
@@ -78,6 +78,19 @@ EXCLUDE_FILES=(
|
|
|
78
78
|
# CI_COMPOSITES.md cites third-party action versions (e.g. v5.0.5),
|
|
79
79
|
# not dotfiles_version. False-positive pattern match.
|
|
80
80
|
"docs/operations/CI_COMPOSITES.md"
|
|
81
|
+
|
|
82
|
+
# Living roadmap: references branch names / target versions
|
|
83
|
+
# (e.g. feature-branch names like feat/v0.2.X, phase milestones)
|
|
84
|
+
# that are NOT the current dotfiles_version. Auto-syncing
|
|
85
|
+
# rewrites them incorrectly.
|
|
86
|
+
"docs/operations/ARCHITECTURE_ROADMAP.md"
|
|
87
|
+
|
|
88
|
+
# Dated release write-ups: each article records the release it
|
|
89
|
+
# shipped in (e.g. "shipped in v0.2.510" + a link to that release
|
|
90
|
+
# tag). Those refs are historical fact, not current-version claims —
|
|
91
|
+
# bumping them would falsify the history.
|
|
92
|
+
"docs/articles/2026-07-05-fish-startup-abbr.md"
|
|
93
|
+
"docs/articles/2026-07-05-master-to-main-rename-runbook.md"
|
|
81
94
|
)
|
|
82
95
|
|
|
83
96
|
# shellcheck source=../lib/dot/ui.sh
|
|
@@ -180,6 +193,16 @@ find_version_files() {
|
|
|
180
193
|
echo "docs/reference/FEATURES.md" >>"$temp_file"
|
|
181
194
|
echo "docs/COPYRIGHT" >>"$temp_file"
|
|
182
195
|
|
|
196
|
+
# Non-markdown and hidden-directory surfaces rg's `--type md` scan above
|
|
197
|
+
# cannot reach: a shell script, and READMEs under the dotfile-hidden
|
|
198
|
+
# `.chezmoitemplates/` tree (rg skips dot-dirs without --hidden). These
|
|
199
|
+
# carry "current version" stamps that check-version-consistency.sh and
|
|
200
|
+
# the test_version_consistency unit test enforce, so keep them in sync.
|
|
201
|
+
echo "scripts/git-hooks/pre-commit-audit.sh" >>"$temp_file"
|
|
202
|
+
echo "defaults/.chezmoitemplates/README.md" >>"$temp_file"
|
|
203
|
+
echo "defaults/.chezmoitemplates/functions/README.md" >>"$temp_file"
|
|
204
|
+
echo "defaults/.chezmoitemplates/aliases/README.md" >>"$temp_file"
|
|
205
|
+
|
|
183
206
|
# Remove duplicates and filter existing files
|
|
184
207
|
sort -u "$temp_file" | while IFS= read -r file; do
|
|
185
208
|
if [[ -f "$file" ]]; then
|
|
@@ -257,8 +280,11 @@ update_version_references() {
|
|
|
257
280
|
temp_file=$(umask 077 && mktemp)
|
|
258
281
|
cp "$file" "$temp_file"
|
|
259
282
|
|
|
260
|
-
# Update various version reference patterns
|
|
261
|
-
|
|
283
|
+
# Update various version reference patterns. Match on the full repo
|
|
284
|
+
# path (not basename) so the root README's badge rules don't also
|
|
285
|
+
# capture other README.md files (e.g. the .chezmoitemplates READMEs),
|
|
286
|
+
# which carry a `(vX.Y.Z)` stamp handled by the generic case below.
|
|
287
|
+
case "$file" in
|
|
262
288
|
"README.md")
|
|
263
289
|
# Update badge and release link versions.
|
|
264
290
|
sed_in_place "$temp_file" \
|
|
@@ -266,6 +292,14 @@ update_version_references() {
|
|
|
266
292
|
-e "s|/releases/tag/v$SED_VERSION_PATTERN|/releases/tag/v$target_version|g" \
|
|
267
293
|
-e "s|/dotfiles/v$SED_VERSION_PATTERN/|/dotfiles/v$target_version/|g"
|
|
268
294
|
;;
|
|
295
|
+
"scripts/git-hooks/pre-commit-audit.sh")
|
|
296
|
+
# "vX.Y.Z standards maintained" banner. Matched explicitly with a
|
|
297
|
+
# portable pattern — the generic `\bvX.Y.Z\b` rule below relies on
|
|
298
|
+
# GNU `\b`, which BSD/macOS sed does not support, so a local
|
|
299
|
+
# `version-sync` run would otherwise leave this script stale.
|
|
300
|
+
sed_in_place "$temp_file" \
|
|
301
|
+
-e "s|v$SED_VERSION_PATTERN standards maintained|v$target_version standards maintained|g"
|
|
302
|
+
;;
|
|
269
303
|
*)
|
|
270
304
|
# Update explicit markdown version labels, backticks, and parentheses.
|
|
271
305
|
# Skip lines containing MILESTONE.
|
package/docs/_config.yml
DELETED
|
@@ -1,59 +0,0 @@
|
|
|
1
|
-
title: ".dotfiles"
|
|
2
|
-
description: "Cross-platform, signed, local-first dotfiles for macOS, Linux, and WSL — published at doc.dotfiles.io."
|
|
3
|
-
url: "https://doc.dotfiles.io"
|
|
4
|
-
baseurl: ""
|
|
5
|
-
|
|
6
|
-
# Jekyll renders this site from docs/ — see .github/workflows/pages.yml.
|
|
7
|
-
# Theme is the GitHub-hosted Cayman skin (zero-Gemfile setup); switch to
|
|
8
|
-
# `remote_theme: just-the-docs/just-the-docs` later if a richer
|
|
9
|
-
# navigation/search UX is wanted (requires plugin allowlist update on
|
|
10
|
-
# GH Pages side).
|
|
11
|
-
theme: jekyll-theme-cayman
|
|
12
|
-
|
|
13
|
-
plugins:
|
|
14
|
-
- jekyll-relative-links
|
|
15
|
-
- jekyll-seo-tag
|
|
16
|
-
- jekyll-sitemap
|
|
17
|
-
- jekyll-redirect-from
|
|
18
|
-
# Renders `README.md` as the directory index where present (matches
|
|
19
|
-
# the GitHub-browse experience for users coming from the repo links
|
|
20
|
-
# in docs/index.md).
|
|
21
|
-
- jekyll-readme-index
|
|
22
|
-
|
|
23
|
-
relative_links:
|
|
24
|
-
enabled: true
|
|
25
|
-
collections: true
|
|
26
|
-
|
|
27
|
-
# Treat *.md as pages so cross-page links work without trailing-slash
|
|
28
|
-
# kludges; include CNAME so the published artifact preserves it across
|
|
29
|
-
# workflow deploys.
|
|
30
|
-
include:
|
|
31
|
-
- CNAME
|
|
32
|
-
- .well-known
|
|
33
|
-
|
|
34
|
-
exclude:
|
|
35
|
-
- "*.tmpl"
|
|
36
|
-
- "manual/_toc.yml"
|
|
37
|
-
- "scripts/"
|
|
38
|
-
- "Gemfile"
|
|
39
|
-
- "Gemfile.lock"
|
|
40
|
-
- "vendor/"
|
|
41
|
-
|
|
42
|
-
markdown: kramdown
|
|
43
|
-
kramdown:
|
|
44
|
-
input: GFM
|
|
45
|
-
syntax_highlighter: rouge
|
|
46
|
-
hard_wrap: false
|
|
47
|
-
|
|
48
|
-
# Many of our docs include chezmoi/Go-template snippets like
|
|
49
|
-
# `{{ .variable }}` inside fenced code blocks. Liquid runs BEFORE
|
|
50
|
-
# kramdown sees those fences and would try to resolve the placeholders
|
|
51
|
-
# as Liquid expressions (silently dropping them from the output). Each
|
|
52
|
-
# .md file therefore carries explicit `render_with_liquid: false` in
|
|
53
|
-
# its frontmatter — a site-wide default in this block was not honored
|
|
54
|
-
# reliably, so we keep the kill-switch per-page instead.
|
|
55
|
-
defaults:
|
|
56
|
-
- scope:
|
|
57
|
-
path: ""
|
|
58
|
-
values:
|
|
59
|
-
layout: default
|