@sebastienrousseau/dotfiles 0.2.516 → 0.2.517

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 This file documents all notable changes to this project.
 
+## v0.2.517 — 2026-08-12
+
+### Changed
+
+- Updated the GitHub Actions minor/patch dependency group across the CI,
+  security, release, documentation, and reliability workflows. The reviewed
+  updates include Harden Runner 2.20.1, Checkout 7.0.1, CodeQL 4.37.6,
+  Checkov Action 12.3115.0, Paths Filter 4.0.3, and Build Provenance 4.2.2.
+- Refreshed all same-repository reusable workflow pins from the v0.2.511
+  baseline to the immutable v0.2.516 commit.
+
+### Fixed
+
+- Kept the block-mode egress and documentation-drift contract tests aligned
+  with the reviewed Harden Runner 2.20.1 SHA, preventing dependency updates
+  from invalidating otherwise-correct CI security policy checks.
+- Documented Dependabot's current support for grouped updates to immutable
+  same-repository reusable workflow references.
+
 ## v0.2.513 — 2026-08-06
 
 - **Verified module registry installation.** `dot registry install` now validates the v1 index, verifies immutable archive SHA-256 digests, rejects traversal and link-bearing archives, previews with chezmoi by default, and applies only with explicit `--yes`. CI validates the published registry contract and JSON Schema.

package/README.md

@@ -10,7 +10,7 @@
 
 <p align="center">
   <a href="https://github.com/sebastienrousseau/dotfiles/actions"><img src="https://img.shields.io/github/actions/workflow/status/sebastienrousseau/dotfiles/ci.yml?style=for-the-badge&logo=githubactions&logoColor=white" alt="Build" /></a>
-  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.516-blue?style=for-the-badge&logo=semanticrelease&logoColor=white" alt="Version" /></a>
+  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.517-blue?style=for-the-badge&logo=semanticrelease&logoColor=white" alt="Version" /></a>
   <a href="https://github.com/sebastienrousseau/dotfiles/releases"><img src="https://img.shields.io/github/downloads/sebastienrousseau/dotfiles/total?style=for-the-badge&logo=github&logoColor=white" alt="Downloads" /></a>
   <a href="https://codespaces.new/sebastienrousseau/dotfiles"><img src="https://img.shields.io/badge/Open%20in-Codespaces-blue?style=for-the-badge&logo=github&logoColor=white" alt="Open in GitHub Codespaces" /></a>
   <a href="https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/dotfiles"><img src="https://img.shields.io/ossf-scorecard/github.com/sebastienrousseau/dotfiles?style=for-the-badge&logo=linuxfoundation&logoColor=white&label=OpenSSF%20Scorecard" alt="OpenSSF Scorecard" /></a>
@@ -52,8 +52,8 @@
 
 ```bash
 curl -fsSL -o /tmp/dotfiles-install.sh \
-  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.516/install.sh
-echo "d5a04c5e2813a93a63c8ecce9655cf3d107f6068862c6eba84a92cf22f801c7e  /tmp/dotfiles-install.sh" \
+  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.517/install.sh
+echo "a105e3c204aa8b71aac101dc9be2e74ca20159053326183b6d0f5f6649588380  /tmp/dotfiles-install.sh" \
   | shasum -a 256 -c
 bash /tmp/dotfiles-install.sh
 ```

package/docs/COPYRIGHT

@@ -1,5 +1,5 @@
 /*
-* 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.516) - <https://github.com/sebastienrousseau/dotfiles>
+* 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.517) - <https://github.com/sebastienrousseau/dotfiles>
 * Made With ❤️ in London, United Kingdom
 * Designed by
 * Copyright (c) 2015-2026. All rights reserved.

package/docs/manual/00-introduction.md

@@ -4,7 +4,7 @@ render_with_liquid: false
 
 # Introduction
 
-This manual describes `.dotfiles` v0.2.516 — a trusted agent workstation baseline for macOS, Linux, and WSL.
+This manual describes `.dotfiles` v0.2.517 — a trusted agent workstation baseline for macOS, Linux, and WSL.
 
 The repository is more than a personal dotfiles collection. It ships as workstation infrastructure: signed, attested, multi-platform, AI-aware, and self-healing. Chezmoi handles templating and platform differences. The `dot` CLI sits on top and coordinates lifecycle operations.
 

package/docs/security/CI_PINNING.md

@@ -99,17 +99,17 @@ intentional before merge.
 
 ## Dependabot
 
-Dependabot's `github-actions` ecosystem **does not** support same-repo
-reusable workflow SHA bumps as of May 2026 — it only updates
-references to external actions. Same-repo reusables are tracked
-manually via the recipe above. The Dependabot config in
-`.github/dependabot.yml` covers the external dimension; this
-document covers the in-repo one.
-
-If GitHub ships native Dependabot support for reusable workflows,
-delete this section and switch to `package-ecosystem: github-actions`
-with `directory: /.github/workflows`. Track on
-[github/feedback#10539](https://github.com/orgs/community/discussions/10539).
+Dependabot's `github-actions` ecosystem now updates full-SHA references to
+same-repository reusable workflows. PR
+[#992](https://github.com/sebastienrousseau/dotfiles/pull/992) verified this
+behavior by moving the reusable workflow baseline from v0.2.511 to the
+immutable v0.2.516 commit alongside the external minor/patch action group.
+
+Keep `bump-reusable-pins.yml` enabled as the immediate post-merge path. It
+updates callers as soon as a reusable workflow changes on `main`, while
+Dependabot provides the scheduled dependency review and grouped update path.
+Both mechanisms must preserve full 40-hex SHA references and pass
+`lint-reusable-pins` plus the egress-policy contract tests.
 
 ## Negative test
 

package/install.sh

@@ -71,7 +71,7 @@ show_help() {
 Usage: install.sh [version] [options]
 
 Arguments:
-  version       The version (tag or branch) to install (default: v0.2.516)
+  version       The version (tag or branch) to install (default: v0.2.517)
 
 Options:
   --help        Show this help message
@@ -87,7 +87,7 @@ EOF
 }
 
 main() {
-  local version="v0.2.516"
+  local version="v0.2.517"
   local version_set=0
   local minimal=0
   local provision="${DOTFILES_PROVISION:-0}"
@@ -117,7 +117,7 @@ main() {
         # like `foobar` doesn't trigger a 30s+ network download attempt.
         # Caught by the install.sh fuzz harness (#881).
         if [[ ! "$arg" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([-+][a-zA-Z0-9.-]+)?$ ]]; then
-          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.516)."
+          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.517)."
         fi
         version="$arg"
         version_set=1
@@ -369,7 +369,7 @@ main() {
   # 6. Initialize & Apply
   step "Applying Configuration..."
 
-  # ── Auto-migration for v0.2.516 reorg ─────────────────────────────────
+  # ── Auto-migration for v0.2.517 reorg ─────────────────────────────────
   # If the user is upgrading from a pre-0.2.503 install, run the
   # migration script BEFORE `chezmoi apply` so the reorg's source-
   # path moves don't cause chezmoi to delete deployed files.
@@ -378,7 +378,7 @@ main() {
   for migrate_src in "$SOURCE_DIR" "$LEGACY_SOURCE_DIR"; do
     migrate_script="$migrate_src/install/migrate/migrate-v0_2-to-v0_2_503.sh"
     if [[ -x "$migrate_script" ]]; then
-      echo "   Running v0.2.516 migration (idempotent; safe on fresh installs)..."
+      echo "   Running v0.2.517 migration (idempotent; safe on fresh installs)..."
       "$migrate_script" || echo "   migration exited non-zero — continuing apply"
       break
     fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebastienrousseau/dotfiles",
-  "version": "0.2.516",
+  "version": "0.2.517",
   "description": "The Trusted Shell Platform — Universal dotfiles managed by Chezmoi. Features Bash & Zsh for macOS, Linux & WSL. Rust modern tooling & enterprise-grade security.",
   "main": "install.sh",
   "bin": {

package/scripts/git-hooks/pre-commit-audit.sh

@@ -141,6 +141,6 @@ if [[ $FAILED -eq 1 ]]; then
   printf '%b\\n' "   (Use --no-verify to bypass if absolutely necessary)"
   exit 1
 else
-  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.516 standards maintained."
+  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.517 standards maintained."
   exit 0
 fi