chore(installer): move release scripts to template-only source

Make install.sh.tmpl and install.ps1.tmpl the installer source of truth, render release assets in CI, remove tracked rendered scripts, and update docs/workflows to match the new model.

Made-with: Cursor

Author: ChipWolf

.github/renovate.json5

@@ -10,7 +10,7 @@
   customManagers: [
     {
       customType: "regex",
-      managerFilePatterns: ["/install\\.sh$/"],
+      managerFilePatterns: ["/install\\.sh\\.tmpl$/"],
       matchStrings: [
         "CRANE_VERSION=\"(?<currentValue>v[^\"]+)\"",
       ],

.github/workflows/_build-container.yml

@@ -33,6 +33,20 @@ jobs:
         env:
           IMAGE_NAME: ${{ inputs.image_registry }}/${{ inputs.image_name }}
 
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+        with:
+          install: true
+
+      - name: Render install.sh from template
+        env:
+          DOTFILES_REPO_URL: ${{ github.server_url }}/${{ github.repository }}
+          DOTFILES_IMAGE_NAME: ${{ steps.image.outputs.name }}
+          DOTFILES_ATTESTATION_REPO: ${{ github.repository }}
+          DOTFILES_RELEASE_TAG: ${{ inputs.tag_name }}
+        run: |
+          mise x -- chezmoi execute-template --file install.sh.tmpl > install.sh
+          chmod +x install.sh
+
       - name: Log in to GHCR
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:

.github/workflows/_upload-scripts.yml

@@ -25,18 +25,21 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - name: Interpolate repo URL in install scripts
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+        with:
+          install: true
+
+      - name: Render install scripts from templates
         env:
-          REPO_URL: ${{ github.server_url }}/${{ github.repository }}
+          DOTFILES_REPO_URL: ${{ github.server_url }}/${{ github.repository }}
           IMAGE_NAME: ${{ inputs.image_registry }}/${{ inputs.image_name }}
-          REPOSITORY: ${{ github.repository }}
+          DOTFILES_ATTESTATION_REPO: ${{ github.repository }}
+          DOTFILES_RELEASE_TAG: ${{ inputs.tag_name }}
         run: |
           IMAGE_NAME_LC="${IMAGE_NAME,,}"
-          sed -i "s|repo_url=\"https://github.com/chipwolf/dotfiles\"|repo_url=\"${REPO_URL}\"|" install.sh
-          sed -i "s|ghcr.io/chipwolf/dotfiles|${IMAGE_NAME_LC}|g" install.sh
-          sed -i "s|--repo chipwolf/dotfiles|--repo ${REPOSITORY}|g" install.sh
-          sed -i "s|\\\$repoUrl = \"https://github.com/chipwolf/dotfiles\"|\$repoUrl = \"${REPO_URL}\"|" install.ps1
-          sed -i "s|https://github.com/chipwolf/dotfiles/releases/download/|${REPO_URL}/releases/download/|g" install.ps1
+          DOTFILES_IMAGE_NAME="${IMAGE_NAME_LC}" mise x -- chezmoi execute-template --file install.sh.tmpl > install.sh
+          DOTFILES_IMAGE_NAME="${IMAGE_NAME_LC}" mise x -- chezmoi execute-template --file install.ps1.tmpl > install.ps1
+          chmod +x install.sh
 
       - name: Upload install scripts to release
         env:

.gitignore

@@ -5,4 +5,7 @@ reviews.local/
 home/dot_config/opencode/private_mcp-atlassian.env
 home/dot_config/opencode/private_slack-mcp.env
 home/dot_config/opencode/skills/onw-monthly-tickets/SKILL.md
+install.sh
+install.ps1
+home/Brewfile
 

AGENTS.md

@@ -34,7 +34,7 @@ See [Concepts](https://www.chezmoi.io/reference/concepts/).
 The file [.chezmoiroot](.chezmoiroot) at the repo root contains `home`. So the **source state** is read from the `home/` directory. All managed targets and special files (e.g. config template, scripts) are under `home/`.
 
 - [.chezmoiroot](https://www.chezmoi.io/reference/special-files/chezmoiroot/) is read first; it sets the path used for the rest of the source state.
-- The working tree (git repo) is the parent of that path; `install.sh`, `.macos`, `.gitignore`, and `README.md` live at repo root and are **not** part of the source state.
+- The working tree (git repo) is the parent of that path; `install.sh.tmpl`, `install.ps1.tmpl`, `.macos`, `.gitignore`, and `README.md` live at repo root and are **not** part of the source state.
 
 ### Naming: source state attributes
 
@@ -124,9 +124,9 @@ Deleting a file from the chezmoi source does **not** remove it from the target (
 - **Other config** – `home/dot_config/` includes tmux, mise, finicky; `home/private_dot_gnupg/` for GnuPG (private permissions).
 - **Executable** – `home/dot_scripts/executable_brew-review` (→ `~/.scripts/brew-review`) is the Homebrew drift review script. `home/dot_scripts/executable_7zw` (→ `~/.scripts/7zw`) is a 7-zip wrapper. Both live in `dot_scripts/` — not `dot_zfunctions/` (see Brew section below).
 - **Bootstrap** – `home/.chezmoiscripts/run_once_before_bootstrap.sh.tmpl` runs once before other updates (install deps, brew bundle, oh-my-zsh, mise, etc.). It is OS-aware (darwin/linux) and sets Codespaces overrides when `codespaces` is true.
-- **Root-level (not in source state)** – `install.sh` runs `chezmoi init --apply --source=...` to bootstrap; `.macos` holds macOS defaults; `.gitignore` excludes local/private artifacts (e.g. `*.local.*`, vim swap/undo). Do not add ignored patterns to the source state.
+- **Root-level (not in source state)** – `install.sh.tmpl` and `install.ps1.tmpl` are installer templates for release assets; `.macos` holds macOS defaults; `.gitignore` excludes local/private artifacts (e.g. `*.local.*`, vim swap/undo). Do not add ignored patterns to the source state.
 - **README "What you get" table** – The tool table in `README.md` is sorted by category: shell/prompt, terminal emulators, multiplexer, editor, dev tools, version control, security, package/runtime management, then platform-specific utilities. When adding or removing a managed tool, update this table and preserve the sort order. Platform columns (macOS, Linux, Windows, Codespaces) must reflect what `.chezmoiignore` actually deploys.
-- **Install script repo URL** – `install.sh` and `install.ps1` hardcode `repo_url` pointing at `chipwolf/dotfiles`. The release workflow (`release.yml`) interpolates this with `github.server_url/github.repository` before uploading to the release, so forks get correct URLs automatically. Do not remove the hardcoded values from the source files; they are needed for local clone execution.
+- **Install script templates** – `install.sh.tmpl` and `install.ps1.tmpl` are the source of truth for release installers. The release workflow renders `install.sh` and `install.ps1` from templates with repository/image/tag values before uploading release assets.
 - **Template readability** – Keep chezmoi template source files readable: use clear indentation, split complex logic into understandable blocks, and avoid flattening everything to the left margin with aggressive whitespace trimming unless required for output correctness.
 
 ---
@@ -137,13 +137,13 @@ Deleting a file from the chezmoi source does **not** remove it from the target (
 - **OS-conditional ignores** in `home/.chezmoiignore` use `{{ if eq .chezmoi.os "windows" }}` and `{{ if ne .chezmoi.os "windows" }}` blocks to control which targets are deployed per platform.
 - **Bash chezmoiscripts** (`run_onchange_after_bootstrap.sh.tmpl`, `run_onchange_after_brew_review.sh.tmpl`, `run_onchange_after_tmux_symlinks.sh.tmpl`) are wrapped in `{{ if ne .chezmoi.os "windows" }}` guards so they render to empty on Windows (chezmoi skips empty scripts).
 - **Windows bootstrap** — `home/.chezmoiscripts/run_onchange_after_bootstrap_windows.ps1.tmpl` installs packages via Chocolatey (`choco install -y`), runs `mise install`, and syncs Neovim plugins. Runs only on Windows.
-- **`install.ps1`** at the repo root is the Windows equivalent of `install.sh`: installs Chocolatey, chezmoi, and git, then runs `chezmoi init --apply`.
+- **`install.ps1.tmpl`** at the repo root is the Windows installer template equivalent of `install.sh.tmpl`: installs Chocolatey, chezmoi, and git, then runs `chezmoi init --apply`.
 - **WezTerm** — `home/dot_config/wezterm/wezterm.lua` (→ `~/.config/wezterm/wezterm.lua`). Windows terminal emulator with kitty graphics protocol support. Ignored on non-Windows via `.chezmoiignore`.
 - **OpenCode** — `home/dot_config/opencode/opencode.jsonc.tmpl` renders MCP and permission data from `home/.chezmoidata/mcps/*.yaml` and `home/.chezmoidata/agent-permissions/*.yaml`. Atlassian entries are gated by `conditions` in those overlays (for example `private: false`), so they are excluded on personal machines. Since Windows is always personal, this also covers Windows.
 - **Package manager** — Windows uses Chocolatey (`choco`), not winget or scoop.
 - **When adding new configs**, decide if the target is cross-platform, Unix-only, or Windows-only, and update `home/.chezmoiignore` accordingly.
 - **When adding new chezmoiscripts**, bash scripts (`.sh.tmpl`) must be guarded with `{{ if ne .chezmoi.os "windows" }}` and PowerShell scripts (`.ps1.tmpl`) with `{{ if eq .chezmoi.os "windows" }}` so they render to empty on the wrong OS.
-- **WSL** — The Windows bootstrap script provisions WSL Ubuntu non-interactively via cloud-init. It writes a cloud-config to `~/.cloud-init/Ubuntu.user-data` (using the Windows username), installs Ubuntu with `--no-launch`, then launches and waits for cloud-init to create the user, clone the dotfiles repo, and run `install.sh`. Inside WSL, `chezmoi.os` is `"linux"` so the full Unix config stack (zsh, brew, tmux, etc.) applies without modification.
+- **WSL** — The Windows bootstrap script provisions WSL Ubuntu non-interactively via cloud-init. It writes a cloud-config to `~/.cloud-init/Ubuntu.user-data` (using the Windows username), installs Ubuntu with `--no-launch`, then launches and waits for cloud-init to create the user, clone the dotfiles repo, install chezmoi, and run `chezmoi init --apply --source=...`. Inside WSL, `chezmoi.os` is `"linux"` so the full Unix config stack (zsh, brew, tmux, etc.) applies without modification.
 
 ---
 

README.md

@@ -114,7 +114,7 @@ chezmoi uses two boolean flags to adapt behavior per machine. Both are set autom
 
 | Flag         | When true                       | What it gates                                                                                                 |
 |--------------|---------------------------------|---------------------------------------------------------------------------------------------------------------|
-| `codespaces` | `CODESPACES` env var is set     | Skips GUI apps and redundant packages in the Brewfile. Uses the overlay fast path in [`install.sh`](install.sh). |
+| `codespaces` | `CODESPACES` env var is set     | Skips GUI apps and redundant packages in the Brewfile. Uses the overlay fast path in [`install.sh.tmpl`](install.sh.tmpl). |
 | `private`    | Windows, or `~/.private` exists | Enables personal-machine config: excludes work-specific MCP servers and Atlassian integrations from OpenCode. |
 
 > [!IMPORTANT]
@@ -166,6 +166,7 @@ Change these files first:
   - `profile.git.name`
   - `profile.git.email`
   - `profile.git.githubUser`
+  - `profile.git.githubRepo` (for WSL bootstrap clone target)
   - `profile.git.signingKey` (optional)
   - `profile.codespaces.gitName`
 - **Git config template**: `home/dot_gitconfig.tmpl` (usually no change needed, only edit if you want different structure)
@@ -190,8 +191,8 @@ Optional removals if not relevant to your setup:
 
 Install scripts note:
 
-- Keep the hardcoded upstream repo values in `install.sh` and `install.ps1` in source.
-- Release automation rewrites those values for your fork's release assets, so local source stays stable while published installers point to your fork.
+- `install.sh.tmpl` and `install.ps1.tmpl` are the installer source of truth.
+- Release automation renders release-ready `install.sh` and `install.ps1` from those templates using the current repository and tag values.
 
 > [!TIP]
 > The chezmoi source state lives under [`home/`](home/) (set by [`.chezmoiroot`](.chezmoiroot)). Filenames use chezmoi's attribute prefixes: `dot_` becomes a leading `.`, `private_` restricts permissions, `executable_` adds the execute bit. [`home/dot_config/nvim/`](home/dot_config/nvim/) deploys to `~/.config/nvim/`.
@@ -218,7 +219,7 @@ All release artifacts are built with [SLSA Build L3](https://slsa.dev/spec/v1.0/
 
 This covers:
 
-- **Install scripts** ([`install.sh`](install.sh), [`install.ps1`](install.ps1)): published as [GitHub Release](https://github.com/chipwolf/dotfiles/releases/tag/v1.6.0) assets. <!-- x-release-please-version -->
+- **Install scripts** ([`install.sh.tmpl`](install.sh.tmpl), [`install.ps1.tmpl`](install.ps1.tmpl)): published as [GitHub Release](https://github.com/chipwolf/dotfiles/releases/tag/v1.6.0) assets after CI template rendering. <!-- x-release-please-version -->
 - **Codespaces overlay image** ([ghcr.io/chipwolf/dotfiles](https://ghcr.io/chipwolf/dotfiles)): published to GHCR.
 
 > [!NOTE]

home/.chezmoidata/profile.yaml

@@ -3,6 +3,7 @@ profile:
     name: "Chip Wolf"
     email: "hello@chipwolf.uk"
     githubUser: "chipwolf"
+    githubRepo: "dotfiles"
     # signingKey: "0x4C90101E11349775"
   codespaces:
     gitName: "Chip Wolf ‮"

home/.chezmoiscripts/run_onchange_after_bootstrap_windows.ps1.tmpl

@@ -26,6 +26,9 @@
   "Wakatime.CLIWakatime"
   "Wakatime.DesktopWakatime"
 -}}
+{{- $dotfilesRepoUser := .profile.git.githubUser -}}
+{{- $dotfilesRepoName := .profile.git.githubRepo -}}
+{{- $dotfilesRepoUrl := printf "https://github.com/%s/%s" $dotfilesRepoUser $dotfilesRepoName -}}
 {{ if eq .chezmoi.os "windows" -}}
 # Chocolatey package list hash (triggers re-run when this list changes):
 # {{ join " " $chocoPackages | sha256sum }}
@@ -97,8 +100,8 @@ write_files:
     default=$wslUser
 
 runcmd:
-  - sudo -u $wslUser git clone https://github.com/chipwolf/dotfiles /home/$wslUser/.local/share/chezmoi
-  - sudo -u $wslUser /home/$wslUser/.local/share/chezmoi/install.sh
+  - sudo -u $wslUser git clone {{ $dotfilesRepoUrl }} /home/$wslUser/.local/share/chezmoi
+  - sudo -u $wslUser bash -lc 'if ! command -v chezmoi >/dev/null 2>&1; then sh -c "$(curl -fsLS get.chezmoi.io)" -- -b "$HOME/.local/bin"; fi; PATH="$HOME/.local/bin:$PATH"; "$HOME/.local/bin/chezmoi" init --apply --source="$HOME/.local/share/chezmoi"'
 "@
             [System.IO.File]::WriteAllText("$cloudInitDir\Ubuntu.user-data", $cloudConfig)
 
@@ -126,10 +129,13 @@ runcmd:
             Write-Host "Updating dotfiles in WSL..."
             wsl -d Ubuntu -- bash -lc '
               if [ ! -d ~/.local/share/chezmoi ]; then
-                git clone https://github.com/chipwolf/dotfiles ~/.local/share/chezmoi
+                git clone {{ $dotfilesRepoUrl }} ~/.local/share/chezmoi
               fi
               cd ~/.local/share/chezmoi && git pull
-              ~/.local/share/chezmoi/install.sh
+              if ! command -v chezmoi >/dev/null 2>&1; then
+                sh -c "$(curl -fsLS get.chezmoi.io)" -- -b "$HOME/.local/bin"
+              fi
+              PATH="$HOME/.local/bin:$PATH" ~/.local/bin/chezmoi init --apply --source="$HOME/.local/share/chezmoi"
             '
         }
     }

install.ps1 install.ps1.tmplinstall.ps1 renamed to install.ps1.tmpl

@@ -1,11 +1,15 @@
-h# install.ps1 — Bootstrap chezmoi dotfiles on Windows.
+{{- $repoURL := env "DOTFILES_REPO_URL" -}}
+{{- $releaseTag := env "DOTFILES_RELEASE_TAG" -}}
+# install.ps1 — Bootstrap chezmoi dotfiles on Windows.
 # Forks: update $repoUrl below to point at your fork.
+#
+# Render source: install.ps1.tmpl
 
 [System.Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingWriteHost', '', Justification = 'Install script uses Write-Host for coloured terminal output')]
 param()
 
-$repoUrl = "https://github.com/chipwolf/dotfiles"
-$rawBase = "https://github.com/chipwolf/dotfiles/releases/download/v1.6.0" # x-release-please-version
+$repoUrl = "{{ $repoURL }}"
+$rawBase = "{{ $repoURL }}/releases/download/{{ $releaseTag }}" # x-release-please-version
 
 $ErrorActionPreference = "Stop"
 

install.sh install.sh.tmplinstall.sh renamed to install.sh.tmpl

@@ -1,11 +1,17 @@
+{{- $repoURL := env "DOTFILES_REPO_URL" -}}
+{{- $imageName := env "DOTFILES_IMAGE_NAME" -}}
+{{- $attestationRepo := env "DOTFILES_ATTESTATION_REPO" -}}
+{{- $releaseTag := env "DOTFILES_RELEASE_TAG" -}}
 #!/bin/sh
 # Forks: update repo_url below to point at your fork.
+#
+# Render source: install.sh.tmpl
 
 # -e: exit on error
 # -u: exit on unset variables
 set -eu
 
-repo_url="https://github.com/chipwolf/dotfiles"
+repo_url="{{ $repoURL }}"
 
 # --- Codespaces fast path ---
 # The GHCR image is a delta-only image (scratch + our overlay layers).
@@ -23,9 +29,9 @@ if [ -n "${CODESPACES:-}" ] && [ -z "${DOTFILES_NO_OVERLAY:-}" ]; then
 		tar -xzf "/tmp/_crane/${CRANE_TAR}" -C /tmp/_crane crane
 		CRANE=/tmp/_crane/crane
 
-		DOTFILES_IMAGE_OWNER="${DOTFILES_IMAGE_OWNER:-chipwolf}"
-		DOTFILES_ATTESTATION_REPO="${DOTFILES_ATTESTATION_REPO:-${DOTFILES_IMAGE_OWNER}/dotfiles}"
-		OUR_IMAGE="ghcr.io/${DOTFILES_IMAGE_OWNER}/dotfiles:v1.6.0" # x-release-please-version
+		DOTFILES_IMAGE_NAME="{{ $imageName }}"
+		DOTFILES_ATTESTATION_REPO="{{ $attestationRepo }}"
+		OUR_IMAGE="${DOTFILES_IMAGE_NAME}:{{ $releaseTag }}" # x-release-please-version
 
 		OUR_MANIFEST=$("$CRANE" manifest "$OUR_IMAGE")
 		OUR_DIGEST=$("$CRANE" digest "$OUR_IMAGE")