@sebastienrousseau/dotfiles 0.2.513 → 0.2.516

package/README.md

@@ -10,7 +10,7 @@
 
 <p align="center">
   <a href="https://github.com/sebastienrousseau/dotfiles/actions"><img src="https://img.shields.io/github/actions/workflow/status/sebastienrousseau/dotfiles/ci.yml?style=for-the-badge&logo=githubactions&logoColor=white" alt="Build" /></a>
-  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.513-blue?style=for-the-badge&logo=semanticrelease&logoColor=white" alt="Version" /></a>
+  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.516-blue?style=for-the-badge&logo=semanticrelease&logoColor=white" alt="Version" /></a>
   <a href="https://github.com/sebastienrousseau/dotfiles/releases"><img src="https://img.shields.io/github/downloads/sebastienrousseau/dotfiles/total?style=for-the-badge&logo=github&logoColor=white" alt="Downloads" /></a>
   <a href="https://codespaces.new/sebastienrousseau/dotfiles"><img src="https://img.shields.io/badge/Open%20in-Codespaces-blue?style=for-the-badge&logo=github&logoColor=white" alt="Open in GitHub Codespaces" /></a>
   <a href="https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/dotfiles"><img src="https://img.shields.io/ossf-scorecard/github.com/sebastienrousseau/dotfiles?style=for-the-badge&logo=linuxfoundation&logoColor=white&label=OpenSSF%20Scorecard" alt="OpenSSF Scorecard" /></a>
@@ -52,7 +52,7 @@
 
 ```bash
 curl -fsSL -o /tmp/dotfiles-install.sh \
-  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.513/install.sh
+  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.516/install.sh
 echo "d5a04c5e2813a93a63c8ecce9655cf3d107f6068862c6eba84a92cf22f801c7e  /tmp/dotfiles-install.sh" \
   | shasum -a 256 -c
 bash /tmp/dotfiles-install.sh

package/docs/COPYRIGHT

@@ -1,5 +1,5 @@
 /*
-* 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.513) - <https://github.com/sebastienrousseau/dotfiles>
+* 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.516) - <https://github.com/sebastienrousseau/dotfiles>
 * Made With ❤️ in London, United Kingdom
 * Designed by
 * Copyright (c) 2015-2026. All rights reserved.

package/docs/manual/00-introduction.md

@@ -4,7 +4,7 @@ render_with_liquid: false
 
 # Introduction
 
-This manual describes `.dotfiles` v0.2.513 — a trusted agent workstation baseline for macOS, Linux, and WSL.
+This manual describes `.dotfiles` v0.2.516 — a trusted agent workstation baseline for macOS, Linux, and WSL.
 
 The repository is more than a personal dotfiles collection. It ships as workstation infrastructure: signed, attested, multi-platform, AI-aware, and self-healing. Chezmoi handles templating and platform differences. The `dot` CLI sits on top and coordinates lifecycle operations.
 

package/docs/operations/HARD_AUDIT_2026.md

@@ -52,8 +52,8 @@ The goal stated by the maintainer: become the de facto workstation provisioning
 
 ### 1.5 What's already excellent (keep)
 
-- **Release supply chain.** `security-release.yml` runs Cosign keyless signing + SBOM generation + SLSA provenance, all SHA-pinned. No findings.
-- **GitHub Actions hygiene.** Every `uses:` is SHA-pinned, reusable workflows blocked by `lint-reusable-pins.sh`. Strong.
+- **Release supply chain.** `security-release.yml` runs Cosign keyless signing + SBOM generation + SLSA provenance. Actions are SHA-pinned except the SLSA generator's required, documented `v2.1.0` tag reference.
+- **GitHub Actions hygiene.** Every non-exempt `uses:` is SHA-pinned; reusable workflows are blocked by `lint-reusable-pins.sh`. Strong.
 - **Secrets handling.** `scripts/lib/secrets_provider.sh` correctly isolates macOS keychain / `pass` / `age` providers with no plaintext leakage.
 - **Test suite.** 4035 unit tests, 47.57% measured line coverage with documented structural ceiling.
 

package/docs/operations/RELEASE_PIPELINE.md

@@ -8,9 +8,10 @@ date: 2026-05-24
 End-to-end flow from `git tag v0.2.503 && git push --tags` to a fully
 signed, distributed release on GitHub + Homebrew + Scoop + AUR.
 
-Five workflows are involved, each scoped to one job and triggered off
-either `release.created` or `release.published`. They run in parallel
-where dependencies allow.
+Release workflows are triggered by either `release.created` or
+`release.published`. Packaging starts at creation; distribution and the
+single security chain start at publication and run in parallel where
+dependencies allow.
 
 ```
             git push --tags                       (you)
@@ -19,26 +20,20 @@ where dependencies allow.
        ┌────────────────────────────┐
        │  GitHub creates Release    │ (auto, from tag)
        └─┬──────────────────────────┘
-         │ on: release.created
-         ▼
-   ┌─────────────────────────────┐   ┌─────────────────────────────┐
-   │  release-package-dot.yml    │   │  security-release.yml (sbom)│
-   │  → dot-VERSION.tar.gz       │   │  → SBOM + cosign sig + cert │
-   │  → dot-VERSION.zip          │   │  → SLSA L3 provenance       │
-   └─────────────┬───────────────┘   └──────────────┬──────────────┘
-                 │ uploaded to release              │
-                 │                                  │
-                 │ on: release.published            │ on: release.published
-                 │ (after human "publish" click,    │ (same trigger)
-                 │  or auto if Release was created  │
-                 │  with assets+published in one)   │
+         ├── on: release.created
+         │       └── release-package-dot.yml
+         │           → dot-VERSION.tar.gz + .zip
+         │
+         └── on: release.published
+                 │
+                 ├──────────────────────────────────┐
                  ▼                                  ▼
    ┌─────────────────────────────┐   ┌─────────────────────────────┐
    │  release-distribute-*.yml   │   │  security-release.yml       │
-   │  ┌─────────────────────┐    │   │  (manifest job)             │
+   │  ┌─────────────────────┐    │   │  → SBOM + provenance        │
    │  │ homebrew → tap PR   │    │   │  → ALL_SHA256SUMS           │
    │  │ scoop    → bucket PR│    │   │  → cosign sig + cert        │
-   │  │ aur      → AUR push │    │   │                             │
+   │  │ aur      → AUR push │    │   │  → verify full bundle       │
    │  └─────────────────────┘    │   └─────────────────────────────┘
    └─────────────────────────────┘
                  │
@@ -54,30 +49,33 @@ where dependencies allow.
 | Workflow | Trigger | Owns | Outputs |
 |---|---|---|---|
 | `release-package-dot.yml` | `release.created`, dispatch | Build deterministic `dot-VERSION.{tar.gz,zip}` from `bin/`, `lib/`, `share/`, completions. | Two release assets. |
-| `security-release.yml` (sbom job) | `release.created`, dispatch | Generate SPDX SBOM via anchore/sbom-action. Cosign keyless sign the SBOM. | `dotfiles-sbom.spdx.json` + `.sig` + `.pem`. |
+| `security-release.yml` (sbom job) | `release.published`, dispatch | Generate SPDX SBOM via anchore/sbom-action. Cosign keyless sign the SBOM. | `dotfiles-sbom.spdx.json` + `.sig` + `.pem`. |
 | `security-release.yml` (provenance job) | needs sbom | SLSA L3 provenance via slsa-framework/slsa-github-generator. | `dotfiles-sbom.spdx.json.intoto.jsonl`. |
-| `security-release.yml` (manifest job) | `release.published`, dispatch | Build `ALL_SHA256SUMS` over every release asset, Cosign-sign it. | `ALL_SHA256SUMS` + `.sig` + `.pem`. |
+| `security-release.yml` (manifest job) | needs provenance + complete asset set | Build `ALL_SHA256SUMS` over every release asset, Cosign-sign it, and verify its signature and digests. | `ALL_SHA256SUMS` + `.sig` + `.pem`. |
 | `release-distribute-homebrew.yml` | `release.published`, dispatch | Hash `dot-VERSION.tar.gz`, regenerate `install/homebrew/dot.rb`, push branch + PR to `sebastienrousseau/homebrew-tap`. | One PR on the tap repo. |
 | `release-distribute-scoop.yml` | `release.published`, dispatch | Hash `dot-VERSION.zip`, rewrite `install/scoop/dot.json` via jq (both 64bit + arm64 point at same zip), PR to `sebastienrousseau/scoop-bucket`. | One PR on the bucket repo. |
 | `release-distribute-aur.yml` | `release.published`, dispatch | Hash `dot-VERSION.tar.gz`, rewrite `pkgver` + `sha256sums` in `install/aur/PKGBUILD`, regenerate `.SRCINFO` via dockerised `makepkg`, push to `ssh://aur@aur.archlinux.org/dot-cli-git.git`. | One commit on AUR. |
 | `release-attestation-check.yml` | weekly cron + dispatch | Verify the latest release carries the full attestation bundle (SBOM + sig + cert + intoto + manifest + sig + cert). | Opens or comments on a tracking issue. |
 
-## Why `created` vs `published`
+## Event ownership and readiness
 
 GitHub fires `release.created` the moment a Release record exists.
-That covers SBOM + SLSA + the packaging step: those depend only on
-source bytes at the tag and don't need other assets to be present.
+That starts the packaging step, which depends only on source bytes at
+the tag and does not need other assets to be present.
 
 `release.published` fires later, when a human flips the Release from
 draft to public (or when a Release is created already-public, the
-events fire together). The manifest job and the three distribution
-jobs wait for that because they enumerate *all* assets on the release;
-running them earlier would miss the manual / docs artefacts uploaded
-by `manual-publish.yml` and the packaging step's tarball + zip.
-
-Both arms of `security-release.yml` are idempotent: re-running the
-manifest job after late asset uploads picks up the new state and the
-`--clobber` flag overwrites the previous manifest sig + cert.
+events fire together). Distribution and the security chain start from
+this event. Publication does not mean independently triggered asset
+publishers have finished, so the manifest job waits for all 13 required
+package, documentation, SBOM, signature, and provenance assets before
+it downloads or signs the bundle. The final integrity job then verifies
+the manifest's Cosign identity and every recorded digest.
+
+Both release and dispatch paths of `security-release.yml` are
+idempotent: re-running the manifest job after late asset uploads picks
+up the new state and the `--clobber` flag overwrites the previous
+manifest sig + cert.
 
 ## Secrets used
 

package/docs/security/CI_PINNING.md

@@ -12,6 +12,14 @@ Every external dependency the CI pipeline consumes must be pinned by
 3. **Container base images** — `FROM image:tag@sha256:<digest>` (closed by [#886](https://github.com/sebastienrousseau/dotfiles/pull/886)).
 4. **Release binaries downloaded at build time** — `curl … && echo "<sha256> ..." | sha256sum -c` (closed by [#888](https://github.com/sebastienrousseau/dotfiles/pull/888)).
 
+The sole exception is the SLSA generic reusable workflow. Its bootstrap
+validates that the caller reference has the form `refs/tags/vX.Y.Z` and
+fails when invoked through a bare commit SHA. Therefore
+`generator_generic_slsa3.yml` is pinned to the exact release tag
+`v2.1.0`; the corresponding commit SHA is recorded beside the call site
+and must be verified before any tag bump. OpenSSF Scorecard explicitly
+exempts the SLSA generator from its SHA-pinning check for this constraint.
+
 ## Why SHA-pin reusable workflows
 
 When `ci.yml` calls a reusable via `./.github/workflows/reusable-X.yml`,

package/install.sh

@@ -71,7 +71,7 @@ show_help() {
 Usage: install.sh [version] [options]
 
 Arguments:
-  version       The version (tag or branch) to install (default: v0.2.513)
+  version       The version (tag or branch) to install (default: v0.2.516)
 
 Options:
   --help        Show this help message
@@ -87,7 +87,7 @@ EOF
 }
 
 main() {
-  local version="v0.2.513"
+  local version="v0.2.516"
   local version_set=0
   local minimal=0
   local provision="${DOTFILES_PROVISION:-0}"
@@ -117,7 +117,7 @@ main() {
         # like `foobar` doesn't trigger a 30s+ network download attempt.
         # Caught by the install.sh fuzz harness (#881).
         if [[ ! "$arg" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([-+][a-zA-Z0-9.-]+)?$ ]]; then
-          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.513)."
+          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.516)."
         fi
         version="$arg"
         version_set=1
@@ -369,7 +369,7 @@ main() {
   # 6. Initialize & Apply
   step "Applying Configuration..."
 
-  # ── Auto-migration for v0.2.513 reorg ─────────────────────────────────
+  # ── Auto-migration for v0.2.516 reorg ─────────────────────────────────
   # If the user is upgrading from a pre-0.2.503 install, run the
   # migration script BEFORE `chezmoi apply` so the reorg's source-
   # path moves don't cause chezmoi to delete deployed files.
@@ -378,7 +378,7 @@ main() {
   for migrate_src in "$SOURCE_DIR" "$LEGACY_SOURCE_DIR"; do
     migrate_script="$migrate_src/install/migrate/migrate-v0_2-to-v0_2_503.sh"
     if [[ -x "$migrate_script" ]]; then
-      echo "   Running v0.2.513 migration (idempotent; safe on fresh installs)..."
+      echo "   Running v0.2.516 migration (idempotent; safe on fresh installs)..."
       "$migrate_script" || echo "   migration exited non-zero — continuing apply"
       break
     fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebastienrousseau/dotfiles",
-  "version": "0.2.513",
+  "version": "0.2.516",
   "description": "The Trusted Shell Platform — Universal dotfiles managed by Chezmoi. Features Bash & Zsh for macOS, Linux & WSL. Rust modern tooling & enterprise-grade security.",
   "main": "install.sh",
   "bin": {

package/scripts/git-hooks/pre-commit-audit.sh

@@ -141,6 +141,6 @@ if [[ $FAILED -eq 1 ]]; then
   printf '%b\\n' "   (Use --no-verify to bypass if absolutely necessary)"
   exit 1
 else
-  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.513 standards maintained."
+  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.516 standards maintained."
   exit 0
 fi

package/scripts/version-sync.sh

@@ -32,6 +32,7 @@ EXCLUDE_FILES=(
   "docs/operations/VERSION_SYNC.md"
   "docs/operations/RFC_v0_2_503_reorganization.md"
   "docs/operations/HARD_AUDIT_2026.md"
+  "docs/operations/COVERAGE.md"
   "docs/reference/ALIASES_DEPRECATIONS.md"
 
   # Security docs — INSTALL_VERIFICATION + CI_PINNING + SCORECARD