@sebastienrousseau/dotfiles 0.2.512 → 0.2.513

package/scripts/ops/heal-tools.sh

@@ -3,6 +3,10 @@
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # shellcheck disable=SC2034
 # =============================================================================
+
+HEAL_TOOLS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../../lib/dot/verified-download.sh disable=SC1091
+source "$HEAL_TOOLS_DIR/../../lib/dot/verified-download.sh"
 # heal-tools.sh — Tool installation helpers for heal.sh
 # Sourced by heal.sh; inherits set -euo pipefail, ui.sh, and shared variables.
 # =============================================================================
@@ -123,33 +127,56 @@ get_package_name() {
 # Usage: _pkg_install "label" completed total command [args...]
 _pkg_install() { ui_run_cmd "$@"; }
 
-# Resolve latest GitHub release tag for a repo
-_gh_latest_tag() {
-  curl -fsSLI -o /dev/null -w '%{url_effective}' "https://github.com/$1/releases/latest" | sed 's|.*/||'
+_mise_tool_specs() {
+  case "$1" in
+    nushell) printf '%s\n' 'aqua:nushell/nushell@0.114.1' ;;
+    pueue)
+      printf '%s\n' 'aqua:Nukesor/pueue/pueue@4.0.4'
+      printf '%s\n' 'aqua:Nukesor/pueue/pueued@4.0.4'
+      ;;
+    wasmtime) printf '%s\n' 'wasmtime@47.0.3' ;;
+    sops) printf '%s\n' 'sops@3.13.3' ;;
+    yazi) printf '%s\n' 'yazi@26.5.6' ;;
+    zellij) printf '%s\n' 'zellij@0.44.3' ;;
+    *) return 1 ;;
+  esac
+}
+
+_install_with_mise() {
+  local cmd="$1" spec
+  command -v mise >/dev/null 2>&1 || return 1
+  while IFS= read -r spec; do
+    [[ -n "$spec" ]] || continue
+    # --pin writes an exact version to the user's writable global config;
+    # aqua/ubi backends verify publisher-provided checksums before install.
+    mise use --global --pin "$spec" || return 1
+  done < <(_mise_tool_specs "$cmd")
 }
 
 # Install a single package (dispatcher for _pkg_install to call in subshell)
 _do_install() {
   local cmd="$1"
   local pkg_mgr="$2"
-  local bin_dir="$HOME/.local/bin"
-  mkdir -p "$bin_dir"
+
+  case "$cmd" in
+    nushell | pueue | wasmtime | sops | yazi | zellij)
+      if _install_with_mise "$cmd"; then
+        return 0
+      fi
+      log_warn "mise install unavailable for $cmd; trying $pkg_mgr"
+      ;;
+  esac
 
   # Binary/curl installers for tools not in standard apt repos
   case "$cmd" in
     starship)
       local installer
       installer=$(umask 077 && mktemp)
-      if ! curl -fsSL -o "$installer" https://starship.rs/install.sh; then
+      if ! download_verified_script https://starship.rs/install.sh "$installer"; then
         rm -f "$installer"
         log_error "Failed to download starship installer"
         return 1
       fi
-      if ! head -1 "$installer" | grep -q '^#!/'; then
-        rm -f "$installer"
-        log_error "starship installer does not look like a shell script"
-        return 1
-      fi
       sh "$installer" --yes
       local rc=$?
       rm -f "$installer"
@@ -158,115 +185,16 @@ _do_install() {
     atuin)
       local installer
       installer=$(umask 077 && mktemp)
-      if ! curl -fsSL -o "$installer" https://setup.atuin.sh; then
+      if ! download_verified_script https://setup.atuin.sh "$installer"; then
         rm -f "$installer"
         log_error "Failed to download atuin installer"
         return 1
       fi
-      if ! head -1 "$installer" | grep -q '^#!/'; then
-        rm -f "$installer"
-        log_error "atuin installer does not look like a shell script"
-        return 1
-      fi
       bash "$installer" --yes
       local rc=$?
       rm -f "$installer"
       return $rc
       ;;
-    nushell)
-      local arch tag ver
-      arch=$(uname -m)
-      tag=$(_gh_latest_tag "nushell/nushell")
-      ver="${tag#v}"
-      local tmp
-      tmp=$(mktemp -d)
-      curl -fsSL -o "$tmp/nu.tar.gz" \
-        "https://github.com/nushell/nushell/releases/download/${tag}/nu-${ver}-${arch}-unknown-linux-musl.tar.gz" &&
-        tar xzf "$tmp/nu.tar.gz" -C "$tmp" --strip-components=1 &&
-        install -m 755 "$tmp/nu" "$bin_dir/nu"
-      local rc=$?
-      rm -rf "$tmp"
-      return $rc
-      ;;
-    pueue)
-      local arch
-      arch=$(uname -m)
-      curl -fsSL -o "$bin_dir/pueue" \
-        "https://github.com/Nukesor/pueue/releases/latest/download/pueue-${arch}-unknown-linux-musl" &&
-        chmod +x "$bin_dir/pueue"
-      curl -fsSL -o "$bin_dir/pueued" \
-        "https://github.com/Nukesor/pueue/releases/latest/download/pueued-${arch}-unknown-linux-musl" &&
-        chmod +x "$bin_dir/pueued"
-      return $?
-      ;;
-    wasmtime)
-      local arch tag
-      arch=$(uname -m)
-      tag=$(_gh_latest_tag "bytecodealliance/wasmtime")
-      local tmp
-      tmp=$(mktemp -d)
-      # xz-utils required for .tar.xz extraction
-      command -v xz >/dev/null 2>&1 || sudo apt-get install -y -qq xz-utils >/dev/null 2>&1 || true
-      curl -fsSL -o "$tmp/wasmtime.tar.xz" \
-        "https://github.com/bytecodealliance/wasmtime/releases/download/${tag}/wasmtime-${tag}-${arch}-linux.tar.xz" &&
-        tar xJf "$tmp/wasmtime.tar.xz" -C "$tmp" --strip-components=1 &&
-        install -m 755 "$tmp/wasmtime" "$bin_dir/wasmtime"
-      local rc=$?
-      rm -rf "$tmp"
-      return $rc
-      ;;
-    sops)
-      local arch tag
-      arch=$(uname -m)
-      [[ "$arch" == "x86_64" ]] && arch="amd64"
-      [[ "$arch" == "aarch64" ]] && arch="arm64"
-      tag=$(_gh_latest_tag "getsops/sops")
-      curl -fsSL -o "$bin_dir/sops" \
-        "https://github.com/getsops/sops/releases/download/${tag}/sops-${tag}.linux.${arch}" &&
-        chmod +x "$bin_dir/sops"
-      return $?
-      ;;
-    hyperfine)
-      local arch tag
-      arch=$(uname -m)
-      tag=$(_gh_latest_tag "sharkdp/hyperfine")
-      local tmp
-      tmp=$(mktemp -d)
-      curl -fsSL -o "$tmp/hyperfine.tar.gz" \
-        "https://github.com/sharkdp/hyperfine/releases/download/${tag}/hyperfine-${tag}-${arch}-unknown-linux-musl.tar.gz" &&
-        tar xzf "$tmp/hyperfine.tar.gz" -C "$tmp" --strip-components=1 &&
-        install -m 755 "$tmp/hyperfine" "$bin_dir/hyperfine"
-      local rc=$?
-      rm -rf "$tmp"
-      return $rc
-      ;;
-    yazi)
-      local arch
-      arch=$(uname -m)
-      local url="https://github.com/sxyazi/yazi/releases/latest/download/yazi-${arch}-unknown-linux-musl.zip"
-      local tmp
-      tmp=$(mktemp -d)
-      command -v unzip >/dev/null 2>&1 || sudo apt-get install -y -qq unzip
-      curl -fsSL -o "$tmp/yazi.zip" "$url" &&
-        (cd "$tmp" && unzip -oq yazi.zip) &&
-        install -m 755 "$tmp"/yazi-*/yazi "$bin_dir/yazi"
-      local rc=$?
-      rm -rf "$tmp"
-      return $rc
-      ;;
-    zellij)
-      local arch
-      arch=$(uname -m)
-      local url="https://github.com/zellij-org/zellij/releases/latest/download/zellij-${arch}-unknown-linux-musl.tar.gz"
-      local tmp
-      tmp=$(mktemp -d)
-      curl -fsSL -o "$tmp/zellij.tar.gz" "$url" &&
-        tar xzf "$tmp/zellij.tar.gz" -C "$tmp" &&
-        install -m 755 "$tmp/zellij" "$bin_dir/zellij"
-      local rc=$?
-      rm -rf "$tmp"
-      return $rc
-      ;;
   esac
 
   # System package manager

package/scripts/qa/reliability-audit.sh

@@ -70,7 +70,7 @@ unit_tests() {
 
 integration_tests() {
   cd "$REPO_ROOT"
-  RUN_INTEGRATION=1 ./tests/framework/test_runner.sh --jobs auto -i
+  ./tests/framework/test_runner.sh --jobs auto --integration-only
 }
 
 coverage_gate() {
@@ -123,11 +123,11 @@ fi
 
 printf 'Reliability Audit\n'
 printf 'Platform: %s\n' "$(platform_name)"
-printf 'Coverage floor: %s%%\n' "$min_coverage"
+printf 'Executable module-mapping floor: %s%%\n' "$min_coverage"
 
 run_step "Shell syntax" shell_syntax
 run_step "Unit suite" unit_tests
-run_step "Module coverage" coverage_gate
+run_step "Executable module mapping" coverage_gate
 run_step "Docs coverage" docs_coverage_gate
 run_step "Traceability coverage" traceability_gate
 run_step "Executable examples" example_gate

package/scripts/qa/scorecard-snapshot.sh

@@ -20,7 +20,7 @@
 
 set -euo pipefail
 
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+REPO_ROOT="${REPO_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$REPO_ROOT"
 
 mode="write"
@@ -51,7 +51,7 @@ if ! command -v jq >/dev/null 2>&1; then
   exit 2
 fi
 
-payload="$(curl -sSfL "$api")" || {
+payload="$(curl --proto '=https' --tlsv1.2 -fsSL --connect-timeout 10 --max-time 30 "$api")" || {
   echo "Scorecard API unreachable: $api" >&2
   exit 2
 }
@@ -75,7 +75,7 @@ trap 'rm -f "$block"' EXIT
         | [.name, (.score|tostring), ((.reason // "") | gsub("\\|"; "\\|") | .[0:100])]
         | "| " + (. | join(" | ")) + " |"'
   # shellcheck disable=SC2016 # backticks here are markdown code-spans, not subshells
-  printf '\n_Refresh: `scripts/qa/scorecard-snapshot.sh` · CI check: `lint/scorecard-snapshot` (planned)._\n'
+  printf '\n_Refresh: `scripts/qa/scorecard-snapshot.sh` · Monitoring: `.github/workflows/scorecard.yml`._\n'
   printf '<!-- END scorecard-snapshot -->\n'
 } >"$block"
 

package/scripts/version-sync.sh

@@ -24,6 +24,7 @@ EXCLUDE_FILES=(
   "docs/reference/FONTS.md"
   "docs/archive/LEGACY_ROADMAP.md"
   "docs/archive/PLAN.md"
+  "ROADMAP.md"
 
   # Roadmap + audit narratives — describe per-version work; refs to
   # prior versions are intentional and historical.
@@ -315,6 +316,10 @@ update_version_references() {
         sed_in_place "$temp_file" \
           -e "s|v$SED_VERSION_PATTERN standards maintained|v$target_version standards maintained|g"
         ;;
+      "docs/manual/00-introduction.md")
+        sed_in_place "$temp_file" \
+          -e "s|\.dotfiles\` v$SED_VERSION_PATTERN|.dotfiles\` v$target_version|g"
+        ;;
       *)
         # Update explicit markdown version labels, backticks, and parentheses.
         # Skip lines containing MILESTONE.
@@ -557,11 +562,33 @@ main() {
     fi
   fi
 
+  # package.json is the release-tooling source used when VERSION is omitted.
+  # A caller-supplied target must update it atomically before downstream
+  # verification, otherwise the repository immediately contains two versions.
+  local package_json="$PROJECT_ROOT/package.json"
+  if [[ "$dry_run" == "true" ]]; then
+    log_info "Would update package.json: version = \"$target_version\""
+  else
+    local package_tmp
+    package_tmp=$(umask 077 && mktemp)
+    if command -v jq >/dev/null 2>&1; then
+      jq --arg version "$target_version" '.version = $version' "$package_json" >"$package_tmp"
+    else
+      cp "$package_json" "$package_tmp"
+      sed_in_place "$package_tmp" "s|\"version\": \"$SED_VERSION_PATTERN\"|\"version\": \"$target_version\"|"
+    fi
+    cat "$package_tmp" >"$package_json"
+    rm -f "$package_tmp"
+    log_success "Updated package.json"
+  fi
+
   # Sync non-template script files that embed the version
   local script_files=(
     "bin/dot"
     "dot_local/bin/executable_tour"
     "install.sh"
+    "lib/dot/bento.sh"
+    "share/man/man1/dot.1"
   )
   for script_file in "${script_files[@]}"; do
     local full_path="$PROJECT_ROOT/$script_file"