@sebastienrousseau/dotfiles 0.2.516 → 0.2.518

package/CHANGELOG.md

@@ -2,6 +2,45 @@
 
 This file documents all notable changes to this project.
 
+## v0.2.518 — 2026-08-13
+
+### Changed
+
+- Added binary-aware cached initialization for mise and zoxide in PowerShell,
+  bringing PowerShell startup behavior in line with Bash, Fish, Nushell, and
+  Zsh.
+- Activated the existing PowerShell 7.5.2 mise installation in the managed
+  workstation tool configuration, preventing an unresolved `pwsh` shim.
+- Pruned duplicate and nonexistent PATH entries after deferred mise hydration
+  so tool upgrades resolve through the current mise environment.
+
+### Fixed
+
+- Normalized chezmoi source paths ending in `defaults` in both Nerd Font hooks.
+  This prevents a verified `dot apply` from failing to locate
+  `lib/dot/verified-download.sh` after the v0.2.503 repository reorganization.
+- Updated workstation diagnostics to recognize the PowerShell cached-init
+  implementation instead of reporting a false shell-coverage warning.
+
+## v0.2.517 — 2026-08-12
+
+### Changed
+
+- Updated the GitHub Actions minor/patch dependency group across the CI,
+  security, release, documentation, and reliability workflows. The reviewed
+  updates include Harden Runner 2.20.1, Checkout 7.0.1, CodeQL 4.37.6,
+  Checkov Action 12.3115.0, Paths Filter 4.0.3, and Build Provenance 4.2.2.
+- Refreshed all same-repository reusable workflow pins from the v0.2.511
+  baseline to the immutable v0.2.516 commit.
+
+### Fixed
+
+- Kept the block-mode egress and documentation-drift contract tests aligned
+  with the reviewed Harden Runner 2.20.1 SHA, preventing dependency updates
+  from invalidating otherwise-correct CI security policy checks.
+- Documented Dependabot's current support for grouped updates to immutable
+  same-repository reusable workflow references.
+
 ## v0.2.513 — 2026-08-06
 
 - **Verified module registry installation.** `dot registry install` now validates the v1 index, verifies immutable archive SHA-256 digests, rejects traversal and link-bearing archives, previews with chezmoi by default, and applies only with explicit `--yes`. CI validates the published registry contract and JSON Schema.
@@ -428,7 +467,7 @@ verified by `dot lint` + the existing test matrix.
 - **`dot_config/shell/00-core-paths.sh.tmpl`** — system paths added via `path_prepend` (which removes duplicates first) instead of `PATH="...:${PATH}"`, eliminating the duplicate-system-path bloat that accumulates when the parent shell already had those entries (macOS launchd default).
 - **`dot_config/zsh/dot_zshrc.tmpl`** — re-apply `typeset -U path` after `_dotfiles_async_init` runs cached `export PATH=...` from mise/atuin/etc, since those bypass zsh's `-U` flag on the `path` array.
 - **`scripts/diagnostics/doctor.sh`** — only flag tools that actually emit shell-init eval and are not already lazy-loaded; raise PATH-length thresholds (60 ok / 120 warn) to match a populated mise-managed dev machine; skip `nu` when `cached_eval.nu` is present.
-- **`dot_config/git/hooks/executable_commit-msg`** — replaced hardcoded `/Users/seb` path with `${HOME}` so the hook is portable across hosts.
+- **`dot_config/git/hooks/executable_commit-msg`** — replaced a hardcoded user-home path with `${HOME}` so the hook is portable across hosts.
 - **`dot_config/fish/conf.d/{direnv,mise-activate}.fish`** — empty shadow files that override Homebrew `vendor_conf.d` to prevent eager init. fish dedupes `conf.d/` by basename, user wins. Saves ~140ms on every fish shell start; both tools are loaded lazily via `_cached_eval` in `init.fish`.
 - **`.devcontainer/Dockerfile`** — chezmoi install now goes through `tools/ci/install-chezmoi-verified.sh` (SHA256-verified) instead of the unverified `curl -fsSL https://get.chezmoi.io` fallback. Closes R4 §8.3 P3 / mirrors R1 H6 fix in `install.sh`.
 - **`typos.toml`** — extended file exclusions (`**/*.asc`, `**/*.pgp`, `**/*.gpg`, `**/*.sig`) to skip armored cryptographic blobs; added `fpr` / `FPR` to the allow-list (GPG `--with-colons` fingerprint column label).

package/README.md

@@ -10,7 +10,7 @@
 
 <p align="center">
   <a href="https://github.com/sebastienrousseau/dotfiles/actions"><img src="https://img.shields.io/github/actions/workflow/status/sebastienrousseau/dotfiles/ci.yml?style=for-the-badge&logo=githubactions&logoColor=white" alt="Build" /></a>
-  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.516-blue?style=for-the-badge&logo=semanticrelease&logoColor=white" alt="Version" /></a>
+  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.518-blue?style=for-the-badge&logo=semanticrelease&logoColor=white" alt="Version" /></a>
   <a href="https://github.com/sebastienrousseau/dotfiles/releases"><img src="https://img.shields.io/github/downloads/sebastienrousseau/dotfiles/total?style=for-the-badge&logo=github&logoColor=white" alt="Downloads" /></a>
   <a href="https://codespaces.new/sebastienrousseau/dotfiles"><img src="https://img.shields.io/badge/Open%20in-Codespaces-blue?style=for-the-badge&logo=github&logoColor=white" alt="Open in GitHub Codespaces" /></a>
   <a href="https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/dotfiles"><img src="https://img.shields.io/ossf-scorecard/github.com/sebastienrousseau/dotfiles?style=for-the-badge&logo=linuxfoundation&logoColor=white&label=OpenSSF%20Scorecard" alt="OpenSSF Scorecard" /></a>
@@ -52,8 +52,8 @@
 
 ```bash
 curl -fsSL -o /tmp/dotfiles-install.sh \
-  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.516/install.sh
-echo "d5a04c5e2813a93a63c8ecce9655cf3d107f6068862c6eba84a92cf22f801c7e  /tmp/dotfiles-install.sh" \
+  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.518/install.sh
+echo "1f8ef5b5ca0de42002269461ded3acc9d30cadc4f77e04d0abfd008d5690c0c5  /tmp/dotfiles-install.sh" \
   | shasum -a 256 -c
 bash /tmp/dotfiles-install.sh
 ```

package/docs/COPYRIGHT

@@ -1,5 +1,5 @@
 /*
-* 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.516) - <https://github.com/sebastienrousseau/dotfiles>
+* 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.518) - <https://github.com/sebastienrousseau/dotfiles>
 * Made With ❤️ in London, United Kingdom
 * Designed by
 * Copyright (c) 2015-2026. All rights reserved.

package/docs/manual/00-introduction.md

@@ -4,7 +4,7 @@ render_with_liquid: false
 
 # Introduction
 
-This manual describes `.dotfiles` v0.2.516 — a trusted agent workstation baseline for macOS, Linux, and WSL.
+This manual describes `.dotfiles` v0.2.518 — a trusted agent workstation baseline for macOS, Linux, and WSL.
 
 The repository is more than a personal dotfiles collection. It ships as workstation infrastructure: signed, attested, multi-platform, AI-aware, and self-healing. Chezmoi handles templating and platform differences. The `dot` CLI sits on top and coordinates lifecycle operations.
 

package/docs/security/CI_PINNING.md

@@ -99,17 +99,17 @@ intentional before merge.
 
 ## Dependabot
 
-Dependabot's `github-actions` ecosystem **does not** support same-repo
-reusable workflow SHA bumps as of May 2026 — it only updates
-references to external actions. Same-repo reusables are tracked
-manually via the recipe above. The Dependabot config in
-`.github/dependabot.yml` covers the external dimension; this
-document covers the in-repo one.
-
-If GitHub ships native Dependabot support for reusable workflows,
-delete this section and switch to `package-ecosystem: github-actions`
-with `directory: /.github/workflows`. Track on
-[github/feedback#10539](https://github.com/orgs/community/discussions/10539).
+Dependabot's `github-actions` ecosystem now updates full-SHA references to
+same-repository reusable workflows. PR
+[#992](https://github.com/sebastienrousseau/dotfiles/pull/992) verified this
+behavior by moving the reusable workflow baseline from v0.2.511 to the
+immutable v0.2.516 commit alongside the external minor/patch action group.
+
+Keep `bump-reusable-pins.yml` enabled as the immediate post-merge path. It
+updates callers as soon as a reusable workflow changes on `main`, while
+Dependabot provides the scheduled dependency review and grouped update path.
+Both mechanisms must preserve full 40-hex SHA references and pass
+`lint-reusable-pins` plus the egress-policy contract tests.
 
 ## Negative test
 

package/install.sh

@@ -71,7 +71,7 @@ show_help() {
 Usage: install.sh [version] [options]
 
 Arguments:
-  version       The version (tag or branch) to install (default: v0.2.516)
+  version       The version (tag or branch) to install (default: v0.2.518)
 
 Options:
   --help        Show this help message
@@ -87,7 +87,7 @@ EOF
 }
 
 main() {
-  local version="v0.2.516"
+  local version="v0.2.518"
   local version_set=0
   local minimal=0
   local provision="${DOTFILES_PROVISION:-0}"
@@ -117,7 +117,7 @@ main() {
         # like `foobar` doesn't trigger a 30s+ network download attempt.
         # Caught by the install.sh fuzz harness (#881).
         if [[ ! "$arg" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([-+][a-zA-Z0-9.-]+)?$ ]]; then
-          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.516)."
+          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.518)."
         fi
         version="$arg"
         version_set=1
@@ -369,7 +369,7 @@ main() {
   # 6. Initialize & Apply
   step "Applying Configuration..."
 
-  # ── Auto-migration for v0.2.516 reorg ─────────────────────────────────
+  # ── Auto-migration for v0.2.518 reorg ─────────────────────────────────
   # If the user is upgrading from a pre-0.2.503 install, run the
   # migration script BEFORE `chezmoi apply` so the reorg's source-
   # path moves don't cause chezmoi to delete deployed files.
@@ -378,7 +378,7 @@ main() {
   for migrate_src in "$SOURCE_DIR" "$LEGACY_SOURCE_DIR"; do
     migrate_script="$migrate_src/install/migrate/migrate-v0_2-to-v0_2_503.sh"
     if [[ -x "$migrate_script" ]]; then
-      echo "   Running v0.2.516 migration (idempotent; safe on fresh installs)..."
+      echo "   Running v0.2.518 migration (idempotent; safe on fresh installs)..."
       "$migrate_script" || echo "   migration exited non-zero — continuing apply"
       break
     fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebastienrousseau/dotfiles",
-  "version": "0.2.516",
+  "version": "0.2.518",
   "description": "The Trusted Shell Platform — Universal dotfiles managed by Chezmoi. Features Bash & Zsh for macOS, Linux & WSL. Rust modern tooling & enterprise-grade security.",
   "main": "install.sh",
   "bin": {

package/scripts/diagnostics/doctor.sh

@@ -628,8 +628,7 @@ else
 fi
 
 # 5. Shell coverage. Surface installed shells that the project's caching
-# infrastructure doesn't currently maintain caches for. zsh/bash/fish/nu
-# all have a `_cached_eval` analogue; pwsh does not.
+# infrastructure doesn't currently maintain caches for.
 shells_unmanaged=""
 for sh in nu pwsh; do
   command -v "$sh" >/dev/null 2>&1 || continue
@@ -637,6 +636,11 @@ for sh in nu pwsh; do
     nu)
       [[ -f "$HOME/.config/nushell/cached_eval.nu" ]] && continue
       ;;
+    pwsh)
+      pwsh -NoLogo -NoProfile -NonInteractive -Command 'exit 0' >/dev/null 2>&1 || continue
+      pwsh_profile="$HOME/.config/powershell/Microsoft.PowerShell_profile.ps1"
+      [[ -f "$pwsh_profile" ]] && grep -q 'Get-DotfilesCachedInit' "$pwsh_profile" && continue
+      ;;
   esac
   shells_unmanaged="${shells_unmanaged:+$shells_unmanaged, }$sh"
 done

package/scripts/git-hooks/pre-commit-audit.sh

@@ -141,6 +141,6 @@ if [[ $FAILED -eq 1 ]]; then
   printf '%b\\n' "   (Use --no-verify to bypass if absolutely necessary)"
   exit 1
 else
-  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.516 standards maintained."
+  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.518 standards maintained."
   exit 0
 fi