@sebastienrousseau/dotfiles 0.2.513 → 0.2.515

package/README.md

@@ -10,7 +10,7 @@
 
 <p align="center">
   <a href="https://github.com/sebastienrousseau/dotfiles/actions"><img src="https://img.shields.io/github/actions/workflow/status/sebastienrousseau/dotfiles/ci.yml?style=for-the-badge&logo=githubactions&logoColor=white" alt="Build" /></a>
-  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.513-blue?style=for-the-badge&logo=semanticrelease&logoColor=white" alt="Version" /></a>
+  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.515-blue?style=for-the-badge&logo=semanticrelease&logoColor=white" alt="Version" /></a>
   <a href="https://github.com/sebastienrousseau/dotfiles/releases"><img src="https://img.shields.io/github/downloads/sebastienrousseau/dotfiles/total?style=for-the-badge&logo=github&logoColor=white" alt="Downloads" /></a>
   <a href="https://codespaces.new/sebastienrousseau/dotfiles"><img src="https://img.shields.io/badge/Open%20in-Codespaces-blue?style=for-the-badge&logo=github&logoColor=white" alt="Open in GitHub Codespaces" /></a>
   <a href="https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/dotfiles"><img src="https://img.shields.io/ossf-scorecard/github.com/sebastienrousseau/dotfiles?style=for-the-badge&logo=linuxfoundation&logoColor=white&label=OpenSSF%20Scorecard" alt="OpenSSF Scorecard" /></a>
@@ -52,7 +52,7 @@
 
 ```bash
 curl -fsSL -o /tmp/dotfiles-install.sh \
-  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.513/install.sh
+  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.515/install.sh
 echo "d5a04c5e2813a93a63c8ecce9655cf3d107f6068862c6eba84a92cf22f801c7e  /tmp/dotfiles-install.sh" \
   | shasum -a 256 -c
 bash /tmp/dotfiles-install.sh

package/docs/COPYRIGHT

@@ -1,5 +1,5 @@
 /*
-* 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.513) - <https://github.com/sebastienrousseau/dotfiles>
+* 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.515) - <https://github.com/sebastienrousseau/dotfiles>
 * Made With ❤️ in London, United Kingdom
 * Designed by
 * Copyright (c) 2015-2026. All rights reserved.

package/docs/manual/00-introduction.md

@@ -4,7 +4,7 @@ render_with_liquid: false
 
 # Introduction
 
-This manual describes `.dotfiles` v0.2.513 — a trusted agent workstation baseline for macOS, Linux, and WSL.
+This manual describes `.dotfiles` v0.2.515 — a trusted agent workstation baseline for macOS, Linux, and WSL.
 
 The repository is more than a personal dotfiles collection. It ships as workstation infrastructure: signed, attested, multi-platform, AI-aware, and self-healing. Chezmoi handles templating and platform differences. The `dot` CLI sits on top and coordinates lifecycle operations.
 

package/docs/operations/HARD_AUDIT_2026.md

@@ -52,8 +52,8 @@ The goal stated by the maintainer: become the de facto workstation provisioning
 
 ### 1.5 What's already excellent (keep)
 
-- **Release supply chain.** `security-release.yml` runs Cosign keyless signing + SBOM generation + SLSA provenance, all SHA-pinned. No findings.
-- **GitHub Actions hygiene.** Every `uses:` is SHA-pinned, reusable workflows blocked by `lint-reusable-pins.sh`. Strong.
+- **Release supply chain.** `security-release.yml` runs Cosign keyless signing + SBOM generation + SLSA provenance. Actions are SHA-pinned except the SLSA generator's required, documented `v2.1.0` tag reference.
+- **GitHub Actions hygiene.** Every non-exempt `uses:` is SHA-pinned; reusable workflows are blocked by `lint-reusable-pins.sh`. Strong.
 - **Secrets handling.** `scripts/lib/secrets_provider.sh` correctly isolates macOS keychain / `pass` / `age` providers with no plaintext leakage.
 - **Test suite.** 4035 unit tests, 47.57% measured line coverage with documented structural ceiling.
 

package/docs/security/CI_PINNING.md

@@ -12,6 +12,14 @@ Every external dependency the CI pipeline consumes must be pinned by
 3. **Container base images** — `FROM image:tag@sha256:<digest>` (closed by [#886](https://github.com/sebastienrousseau/dotfiles/pull/886)).
 4. **Release binaries downloaded at build time** — `curl … && echo "<sha256> ..." | sha256sum -c` (closed by [#888](https://github.com/sebastienrousseau/dotfiles/pull/888)).
 
+The sole exception is the SLSA generic reusable workflow. Its bootstrap
+validates that the caller reference has the form `refs/tags/vX.Y.Z` and
+fails when invoked through a bare commit SHA. Therefore
+`generator_generic_slsa3.yml` is pinned to the exact release tag
+`v2.1.0`; the corresponding commit SHA is recorded beside the call site
+and must be verified before any tag bump. OpenSSF Scorecard explicitly
+exempts the SLSA generator from its SHA-pinning check for this constraint.
+
 ## Why SHA-pin reusable workflows
 
 When `ci.yml` calls a reusable via `./.github/workflows/reusable-X.yml`,

package/install.sh

@@ -71,7 +71,7 @@ show_help() {
 Usage: install.sh [version] [options]
 
 Arguments:
-  version       The version (tag or branch) to install (default: v0.2.513)
+  version       The version (tag or branch) to install (default: v0.2.515)
 
 Options:
   --help        Show this help message
@@ -87,7 +87,7 @@ EOF
 }
 
 main() {
-  local version="v0.2.513"
+  local version="v0.2.515"
   local version_set=0
   local minimal=0
   local provision="${DOTFILES_PROVISION:-0}"
@@ -117,7 +117,7 @@ main() {
         # like `foobar` doesn't trigger a 30s+ network download attempt.
         # Caught by the install.sh fuzz harness (#881).
         if [[ ! "$arg" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([-+][a-zA-Z0-9.-]+)?$ ]]; then
-          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.513)."
+          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.515)."
         fi
         version="$arg"
         version_set=1
@@ -369,7 +369,7 @@ main() {
   # 6. Initialize & Apply
   step "Applying Configuration..."
 
-  # ── Auto-migration for v0.2.513 reorg ─────────────────────────────────
+  # ── Auto-migration for v0.2.515 reorg ─────────────────────────────────
   # If the user is upgrading from a pre-0.2.503 install, run the
   # migration script BEFORE `chezmoi apply` so the reorg's source-
   # path moves don't cause chezmoi to delete deployed files.
@@ -378,7 +378,7 @@ main() {
   for migrate_src in "$SOURCE_DIR" "$LEGACY_SOURCE_DIR"; do
     migrate_script="$migrate_src/install/migrate/migrate-v0_2-to-v0_2_503.sh"
     if [[ -x "$migrate_script" ]]; then
-      echo "   Running v0.2.513 migration (idempotent; safe on fresh installs)..."
+      echo "   Running v0.2.515 migration (idempotent; safe on fresh installs)..."
       "$migrate_script" || echo "   migration exited non-zero — continuing apply"
       break
     fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebastienrousseau/dotfiles",
-  "version": "0.2.513",
+  "version": "0.2.515",
   "description": "The Trusted Shell Platform — Universal dotfiles managed by Chezmoi. Features Bash & Zsh for macOS, Linux & WSL. Rust modern tooling & enterprise-grade security.",
   "main": "install.sh",
   "bin": {

package/scripts/git-hooks/pre-commit-audit.sh

@@ -141,6 +141,6 @@ if [[ $FAILED -eq 1 ]]; then
   printf '%b\\n' "   (Use --no-verify to bypass if absolutely necessary)"
   exit 1
 else
-  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.513 standards maintained."
+  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.515 standards maintained."
   exit 0
 fi

package/scripts/version-sync.sh

@@ -32,6 +32,7 @@ EXCLUDE_FILES=(
   "docs/operations/VERSION_SYNC.md"
   "docs/operations/RFC_v0_2_503_reorganization.md"
   "docs/operations/HARD_AUDIT_2026.md"
+  "docs/operations/COVERAGE.md"
   "docs/reference/ALIASES_DEPRECATIONS.md"
 
   # Security docs — INSTALL_VERIFICATION + CI_PINNING + SCORECARD