@sebastienrousseau/dotfiles 0.2.519 → 0.2.521

package/scripts/qa/reliability-audit.sh

@@ -1,139 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-
-mode="full"
-run_integration=0
-min_coverage="${MIN_COVERAGE:-100}"
-
-platform_name() {
-  case "$(uname -s)" in
-    Darwin) echo "macOS" ;;
-    Linux)
-      if grep -qi microsoft /proc/version 2>/dev/null; then
-        echo "WSL"
-      else
-        echo "Linux"
-      fi
-      ;;
-    *) echo "Unknown" ;;
-  esac
-}
-
-usage() {
-  cat <<'EOF'
-Reliability Audit
-
-Usage:
-  reliability-audit.sh [--quick] [--unit-only] [--with-integration]
-
-Options:
-  --quick             Run syntax, unit, coverage, and examples
-  --unit-only         Run syntax, unit, coverage, and examples
-  --with-integration  Include integration tests
-EOF
-}
-
-run_step() {
-  local label="$1"
-  shift
-  printf '\n[%s] %s\n' "$(date +%H:%M:%S)" "$label"
-  "$@"
-}
-
-shell_syntax() {
-  local failed=0
-  local file
-
-  while IFS= read -r -d '' file; do
-    if ! bash -n "$file"; then
-      failed=$((failed + 1))
-    fi
-  done < <(find "$REPO_ROOT" \
-    \( -path "$REPO_ROOT/.git" -o -path "$REPO_ROOT/.coverage" \) -prune \
-    -o -type f \( -name "*.sh" -o -name "*.bash" \) -print0)
-
-  if [ "$failed" -ne 0 ]; then
-    printf 'Syntax failures: %s\n' "$failed" >&2
-    return 1
-  fi
-}
-
-unit_tests() {
-  cd "$REPO_ROOT"
-  ./tests/framework/test_runner.sh --jobs auto
-}
-
-integration_tests() {
-  cd "$REPO_ROOT"
-  ./tests/framework/test_runner.sh --jobs auto --integration-only
-}
-
-coverage_gate() {
-  cd "$REPO_ROOT"
-  MIN_COVERAGE="$min_coverage" ./tests/framework/module_coverage.sh
-}
-
-example_gate() {
-  cd "$REPO_ROOT"
-  bash ./scripts/qa/validate-examples.sh
-}
-
-docs_coverage_gate() {
-  cd "$REPO_ROOT"
-  bash ./scripts/qa/docs-coverage.sh
-}
-
-traceability_gate() {
-  cd "$REPO_ROOT"
-  bash ./scripts/qa/traceability-coverage.sh
-}
-
-while [ "$#" -gt 0 ]; do
-  case "$1" in
-    --quick)
-      mode="quick"
-      ;;
-    --unit-only)
-      mode="unit"
-      ;;
-    --with-integration)
-      run_integration=1
-      ;;
-    -h | --help)
-      usage
-      exit 0
-      ;;
-    *)
-      printf 'Unknown option: %s\n' "$1" >&2
-      usage >&2
-      exit 1
-      ;;
-  esac
-  shift
-done
-
-if [ "$mode" = "full" ]; then
-  run_integration=1
-fi
-
-printf 'Reliability Audit\n'
-printf 'Platform: %s\n' "$(platform_name)"
-printf 'Executable module-mapping floor: %s%%\n' "$min_coverage"
-
-run_step "Shell syntax" shell_syntax
-run_step "Unit suite" unit_tests
-run_step "Executable module mapping" coverage_gate
-run_step "Docs coverage" docs_coverage_gate
-run_step "Traceability coverage" traceability_gate
-run_step "Executable examples" example_gate
-
-if [ "$run_integration" -eq 1 ]; then
-  run_step "Integration suite" integration_tests
-fi
-
-printf '\nReliability audit passed.\n'

package/scripts/qa/scorecard-snapshot.sh

@@ -1,128 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-#
-# Fetch the current OpenSSF Scorecard result and refresh the
-# per-check posture table in docs/security/SCORECARD.md.
-#
-# The narrative sections (open findings, exceptions, closed-this-
-# cycle log) are preserved as-is — only the auto-generated
-# baseline block between the BEGIN/END markers is rewritten.
-#
-# Usage:
-#   scripts/qa/scorecard-snapshot.sh           # refresh
-#   scripts/qa/scorecard-snapshot.sh --check   # exit 1 if stale
-#
-# Exit codes:
-#   0  snapshot up-to-date / written
-#   1  --check mode and content drifted
-#   2  bad usage / Scorecard API unreachable
-
-set -euo pipefail
-
-REPO_ROOT="${REPO_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
-cd "$REPO_ROOT"
-
-mode="write"
-for arg in "$@"; do
-  case "$arg" in
-    --check) mode="check" ;;
-    -h | --help)
-      sed -n '2,16p' "$0"
-      exit 0
-      ;;
-    *)
-      echo "unknown flag: $arg" >&2
-      exit 2
-      ;;
-  esac
-done
-
-api='https://api.scorecard.dev/projects/github.com/sebastienrousseau/dotfiles'
-target='docs/security/SCORECARD.md'
-
-[[ -f "$target" ]] || {
-  echo "target not found: $target" >&2
-  exit 2
-}
-
-if ! command -v jq >/dev/null 2>&1; then
-  echo "jq required" >&2
-  exit 2
-fi
-
-payload="$(curl --proto '=https' --tlsv1.2 -fsSL --connect-timeout 10 --max-time 30 "$api")" || {
-  echo "Scorecard API unreachable: $api" >&2
-  exit 2
-}
-
-aggregate="$(printf '%s' "$payload" | jq -r '.score')"
-date="$(printf '%s' "$payload" | jq -r '.date')"
-
-# Build the auto-block: per-check status + score, one row each.
-block="$(mktemp)"
-trap 'rm -f "$block"' EXIT
-
-{
-  printf '<!-- BEGIN scorecard-snapshot (auto-generated, do not edit by hand) -->\n'
-  printf 'Aggregate score **%s / 10** at %s.\n\n' "$aggregate" "$date"
-  printf '| Check | Score | Reason |\n'
-  printf '|---|---:|---|\n'
-  printf '%s' "$payload" |
-    jq -r '.checks
-        | sort_by(.name)
-        | .[]
-        | [.name, (.score|tostring), ((.reason // "") | gsub("\\|"; "\\|") | .[0:100])]
-        | "| " + (. | join(" | ")) + " |"'
-  # shellcheck disable=SC2016 # backticks here are markdown code-spans, not subshells
-  printf '\n_Refresh: `scripts/qa/scorecard-snapshot.sh` · Monitoring: `.github/workflows/scorecard.yml`._\n'
-  printf '<!-- END scorecard-snapshot -->\n'
-} >"$block"
-
-# Splice the block into the target. Find the BEGIN/END markers; if
-# they're not yet present, append the block after the "## Live
-# score" section header.
-out="$(mktemp)"
-trap 'rm -f "$block" "$out"' EXIT
-
-if grep -q '<!-- BEGIN scorecard-snapshot' "$target"; then
-  awk -v blockfile="$block" '
-    BEGIN { skip = 0 }
-    /<!-- BEGIN scorecard-snapshot/ {
-      skip = 1
-      while ((getline line < blockfile) > 0) print line
-      close(blockfile)
-      next
-    }
-    /<!-- END scorecard-snapshot -->/ {
-      skip = 0
-      next
-    }
-    skip == 0 { print }
-  ' "$target" >"$out"
-else
-  # First run — inject right after the "## Live score" h2.
-  awk -v blockfile="$block" '
-    { print }
-    /^## Live score$/ && !inserted {
-      print ""
-      while ((getline line < blockfile) > 0) print line
-      close(blockfile)
-      inserted = 1
-    }
-  ' "$target" >"$out"
-fi
-
-if [[ "$mode" == "check" ]]; then
-  if ! diff -q "$target" "$out" >/dev/null 2>&1; then
-    echo "SCORECARD.md snapshot is stale (live score: $aggregate)." >&2
-    diff -u "$target" "$out" | head -50 >&2
-    exit 1
-  fi
-  echo "SCORECARD.md snapshot is in sync (aggregate: $aggregate)"
-  exit 0
-fi
-
-mv "$out" "$target"
-trap - EXIT
-echo "Refreshed $target (aggregate: $aggregate as of $date)"

package/scripts/qa/traceability-coverage.sh

@@ -1,117 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-TRACE_DOC="$REPO_ROOT/docs/operations/TRACEABILITY.md"
-MIN_TRACEABILITY_COVERAGE="${MIN_TRACEABILITY_COVERAGE:-100}"
-
-TOTAL_TRACE_CHECKS=0
-COVERED_TRACE_CHECKS=0
-
-extract_impl_paths() {
-  awk '
-    /^\| BT-/ {
-      cols = $0
-      sub(/^\|[[:space:]]*/, "", cols)
-      sub(/[[:space:]]*\|[[:space:]]*$/, "", cols)
-      n = split(cols, parts, /\|/)
-      gsub(/^[[:space:]]+|[[:space:]]+$/, "", parts[3])
-      split(parts[3], impls, /,/)
-      for (i in impls) {
-        gsub(/^[[:space:]]+|[[:space:]]+$/, "", impls[i])
-        gsub(/`/, "", impls[i])
-        print impls[i]
-      }
-    }
-  ' "$TRACE_DOC" | sort -u
-}
-
-trim() {
-  sed 's/^[[:space:]]*//; s/[[:space:]]*$//'
-}
-
-record_trace_check() {
-  local label="$1"
-  local target="$2"
-
-  TOTAL_TRACE_CHECKS=$((TOTAL_TRACE_CHECKS + 1))
-  if [ -e "$target" ]; then
-    COVERED_TRACE_CHECKS=$((COVERED_TRACE_CHECKS + 1))
-  else
-    printf 'Missing traceability target: %s (%s)\n' "$label" "$target" >&2
-  fi
-}
-
-check_path_list() {
-  local kind="$1"
-  local value="$2"
-  local behavior_id="$3"
-  local rel=""
-
-  while IFS= read -r rel; do
-    rel="$(printf '%s' "$rel" | trim)"
-    [ -n "$rel" ] || continue
-    rel="${rel#\`}"
-    rel="${rel%\`}"
-    record_trace_check "$behavior_id $kind" "$REPO_ROOT/$rel"
-  done < <(printf '%s\n' "$value" | tr ',' '\n')
-}
-
-report_traceability() {
-  local pct
-  pct="$(awk -v c="$COVERED_TRACE_CHECKS" -v t="$TOTAL_TRACE_CHECKS" 'BEGIN{if(t==0){print "0.00"}else{printf "%.2f", (100*c/t)}}')"
-
-  printf 'Traceability coverage: %s/%s (%s%%)\n' "$COVERED_TRACE_CHECKS" "$TOTAL_TRACE_CHECKS" "$pct"
-  printf 'Threshold: %s%%\n' "$MIN_TRACEABILITY_COVERAGE"
-
-  awk -v p="$pct" -v min="$MIN_TRACEABILITY_COVERAGE" 'BEGIN{exit !(p+0 >= min+0)}'
-}
-
-main() {
-  local line=""
-  local cols=""
-  local behavior_id=""
-  local impls=""
-  local tests=""
-  local docs=""
-
-  while IFS= read -r line; do
-    case "$line" in
-      \|\ BT-*)
-        cols="$(printf '%s\n' "$line" | sed 's/^|//; s/|$//')"
-        behavior_id="$(printf '%s\n' "$cols" | cut -d'|' -f1 | trim)"
-        impls="$(printf '%s\n' "$cols" | cut -d'|' -f3 | trim)"
-        tests="$(printf '%s\n' "$cols" | cut -d'|' -f4 | trim)"
-        docs="$(printf '%s\n' "$cols" | cut -d'|' -f5 | trim)"
-
-        check_path_list "implementation" "$impls" "$behavior_id"
-        check_path_list "test" "$tests" "$behavior_id"
-        check_path_list "doc" "$docs" "$behavior_id"
-        ;;
-    esac
-  done <"$TRACE_DOC"
-
-  while IFS= read -r required; do
-    [ -n "$required" ] || continue
-    TOTAL_TRACE_CHECKS=$((TOTAL_TRACE_CHECKS + 1))
-    if extract_impl_paths | grep -Fxq "$required"; then
-      COVERED_TRACE_CHECKS=$((COVERED_TRACE_CHECKS + 1))
-    else
-      printf 'Missing traceability row for implementation: %s\n' "$required" >&2
-    fi
-  done < <(
-    {
-      find "$REPO_ROOT/scripts/dot/commands" -maxdepth 1 -type f -name '*.sh' | sed "s#^$REPO_ROOT/##"
-      find "$REPO_ROOT/scripts/qa" -maxdepth 1 -type f -name '*.sh' | sed "s#^$REPO_ROOT/##"
-    } | sort -u
-  )
-
-  report_traceability
-
-  printf 'PASS: core internal behaviors have implementation, test, and documentation traceability at or above the required threshold\n'
-}
-
-main "$@"

package/scripts/qa/validate-examples.sh

@@ -1,27 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-EXAMPLES_DIR="$REPO_ROOT/examples"
-
-if [ ! -d "$EXAMPLES_DIR" ]; then
-  echo "No examples directory found: $EXAMPLES_DIR" >&2
-  exit 1
-fi
-
-found=0
-while IFS= read -r -d '' example; do
-  found=1
-  printf 'Running example: %s\n' "$(basename "$example")"
-  bash "$example"
-done < <(find "$EXAMPLES_DIR" -maxdepth 1 -type f -name "*.sh" -print0 | sort -z)
-
-if [ "$found" -eq 0 ]; then
-  echo "No executable examples found in $EXAMPLES_DIR" >&2
-  exit 1
-fi
-
-printf 'Examples passed.\n'

package/scripts/qa/wsl-contract.sh

@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-
-cd "$REPO_ROOT"
-
-bash tests/unit/install/test_os_detection_comprehensive.sh
-bash tests/unit/functions/test_platform_detection_behavior.sh

package/scripts/secrets/age-init.sh

@@ -1,82 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-set -euo pipefail
-
-SECRETS_DIR="$HOME/.config/chezmoi"
-KEY_FILE="$SECRETS_DIR/key.txt"
-CONFIG_FILE="$SECRETS_DIR/chezmoi.toml"
-
-mkdir -p "$SECRETS_DIR"
-
-if ! command -v age-keygen >/dev/null; then
-  echo "age-keygen not found. Install 'age' first." >&2
-  exit 1
-fi
-
-if [[ ! -f "$KEY_FILE" ]]; then
-  age-keygen -o "$KEY_FILE"
-  chmod 600 "$KEY_FILE"
-  echo "Age key created at $KEY_FILE"
-else
-  echo "Age key already exists: $KEY_FILE"
-fi
-
-recipient=$(age-keygen -y "$KEY_FILE")
-
-python3 - "$CONFIG_FILE" "$KEY_FILE" "$recipient" <<'PY'
-import sys
-import json
-from pathlib import Path
-
-config_path = Path(sys.argv[1])
-key_file = sys.argv[2]
-recipient = sys.argv[3]
-
-content = ""
-if config_path.exists():
-    content = config_path.read_text(encoding="utf-8")
-
-lines = content.splitlines()
-
-# Remove existing encryption keys and age blocks regardless of where a previous
-# run placed them.
-out = []
-in_age = False
-for line in lines:
-    if line.strip().startswith("[age]"):
-        in_age = True
-        continue
-    if in_age:
-        if line.strip().startswith("["):
-            in_age = False
-            out.append(line)
-        else:
-            continue
-    else:
-        if line.strip().startswith("encryption ="):
-            continue
-        out.append(line)
-
-# Keep encryption at top level; chezmoi warns when it is nested under [data].
-insert_at = 0
-for i, line in enumerate(out):
-    if line.strip().startswith("["):
-        insert_at = i
-        break
-else:
-    insert_at = len(out)
-
-top_level = ["encryption = \"age\"", ""]
-out[insert_at:insert_at] = top_level
-
-# Append updated age config (use json.dumps for safe string escaping)
-out.append("")
-out.append("[age]")
-out.append(f"identity = {json.dumps(key_file)}")
-out.append(f"recipient = {json.dumps(recipient)}")
-
-config_path.write_text("\n".join(out).rstrip() + "\n", encoding="utf-8")
-PY
-
-echo "Updated $CONFIG_FILE with age encryption settings."

package/scripts/secrets/create-secrets-file.sh

@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-set -euo pipefail
-
-OUT_FILE="${1:-$HOME/.config/chezmoi/encrypted_secrets.env.age}"
-KEYRING_DIR="$HOME/.config/chezmoi"
-AGE_KEY="$KEYRING_DIR/key.txt"
-
-if [ ! -f "$AGE_KEY" ]; then
-  echo "Age identity not found: $AGE_KEY"
-  echo "Run: dot secrets-init"
-  exit 1
-fi
-
-if ! command -v age >/dev/null; then
-  echo "age not found. Install it first."
-  exit 1
-fi
-
-if [ -f "$OUT_FILE" ]; then
-  echo "Secrets file already exists: $OUT_FILE"
-  exit 0
-fi
-
-recipient="$(age-keygen -y "$AGE_KEY")"
-mkdir -p "$(dirname "$OUT_FILE")"
-
-tmp_secrets="$(umask 077 && mktemp)" || exit 1
-tmp_recipient="$(umask 077 && mktemp)" || exit 1
-trap 'rm -f "$tmp_secrets" "$tmp_recipient"' EXIT
-
-printf "%s\n" "# Add secrets as KEY=VALUE" "EXAMPLE_TOKEN=change_me" >"$tmp_secrets"
-printf "%s" "$recipient" >"$tmp_recipient"
-
-age -R "$tmp_recipient" -o "$OUT_FILE" "$tmp_secrets"
-
-chmod 600 "$OUT_FILE"
-
-cat <<MSG
-Created encrypted secrets file:
-  $OUT_FILE
-
-Edit it with:
-  dot secrets
-MSG

package/scripts/secrets/encrypt-ssh-key.sh

@@ -1,44 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-set -euo pipefail
-
-KEY_PATH="${1:-$HOME/.ssh/id_ed25519}"
-OUT_FILE="${2:-$HOME/.config/chezmoi/encrypted_id_ed25519.age}"
-KEYRING_DIR="$HOME/.config/chezmoi"
-AGE_KEY="$KEYRING_DIR/key.txt"
-
-if [ ! -f "$KEY_PATH" ]; then
-  echo "SSH key not found: $KEY_PATH"
-  exit 1
-fi
-
-if [ ! -f "$AGE_KEY" ]; then
-  echo "Age identity not found: $AGE_KEY"
-  echo "Run: dot secrets-init"
-  exit 1
-fi
-
-if ! command -v age >/dev/null; then
-  echo "age not found. Install it first."
-  exit 1
-fi
-
-recipient="$(age-keygen -y "$AGE_KEY")"
-mkdir -p "$(dirname "$OUT_FILE")"
-
-if [ -f "$OUT_FILE" ]; then
-  echo "Encrypted file already exists: $OUT_FILE"
-  exit 0
-fi
-
-age -R <(printf "%s" "$recipient") -o "$OUT_FILE" "$KEY_PATH"
-chmod 600 "$OUT_FILE"
-
-cat <<MSG
-Encrypted SSH key written to:
-  $OUT_FILE
-
-This file is local only. If you want to track it in dotfiles, run:
-  chezmoi add --encrypt $OUT_FILE
-MSG

package/scripts/security/backup.sh

@@ -1,58 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-## Create compressed backup of home directory.
-##
-## Archives the home directory (excluding cache and trash) to a timestamped
-# shellcheck disable=SC1091
-## .tgz file. Supports custom source and destination directories via
-## environment variables.
-##
-## # Usage
-## dot backup
-## DOTFILES_BACKUP_DIR=/mnt/backup dot backup
-##
-## # Dependencies
-## - tar: Archive creation
-##
-## # Environment Variables
-## | Variable | Default | Description |
-## |----------|---------|-------------|
-## | DOTFILES_BACKUP_DIR | ~/.backups | Backup destination |
-## | DOTFILES_BACKUP_SRC | ~/ | Source directory |
-##
-## # Platform Notes
-## - macOS: Uses BSD tar
-## - Linux: Uses GNU tar
-## - WSL: Backup stored in Linux filesystem for performance
-##
-## # Security
-## Does not encrypt backups. Use age/gpg for sensitive data.
-##
-## # Idempotency
-## Creates new timestamped backup on each run.
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../../lib/dot/ui.sh
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/ui.sh"
-
-ui_init
-ui_header "Backup"
-
-BACKUP_DIR="${DOTFILES_BACKUP_DIR:-$HOME/.backups}"
-SRC_DIR="${DOTFILES_BACKUP_SRC:-$HOME}"
-STAMP=$(date +%Y%m%d-%H%M%S)
-OUT="$BACKUP_DIR/dotfiles-backup-$STAMP.tgz"
-
-mkdir -p "$BACKUP_DIR"
-
-if ! tar --exclude="$HOME/.cache" --exclude="$HOME/.local/share/Trash" -czf "$OUT" "$SRC_DIR"; then
-  ui_err "Backup failed"
-  rm -f "$OUT"
-  exit 1
-fi
-
-ui_ok "Backup written" "$OUT"