feat: enhance CI/CD with linting, security scanning, and testing

.github/workflows/lint.yml

@@ -0,0 +1,45 @@
+name: Lint
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: ShellCheck
+        uses: luizm/action-sh-checker@master
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SHFMT_OPTS: -i 2 -ci
+        with:
+          sh_checker_comment: true
+          sh_checker_exclude: ".git"
+
+  shfmt:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.head_ref }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Setup shfmt
+        run: |
+          curl -sS https://webinstall.dev/shfmt | bash
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+      - name: Run shfmt
+        run: shfmt -i 2 -ci -w .
+      - name: Commit changes
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          commit_message: "style: auto-format shell scripts with shfmt"
+
+  yamllint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: frenck/action-yamllint@v1

.github/workflows/security.yml

@@ -0,0 +1,18 @@
+name: Security
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test.yml

@@ -0,0 +1,19 @@
+name: Test
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  e2e:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Run install.sh
+        run: ./install.sh
+      - name: Setup Bats
+        run: brew install bats-core
+      - name: Run Bats tests
+        run: bats tests/

.gitleaks.toml

@@ -0,0 +1,5 @@
+[allowlist]
+paths = [
+  ".config/1Password/",
+  ".ssh/config",
+]

.pre-commit-config.yaml

@@ -0,0 +1,21 @@
+repos:
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: v0.10.0.1
+    hooks:
+      - id: shellcheck
+
+  - repo: https://github.com/scop/pre-commit-shfmt
+    rev: v3.8.0-1
+    hooks:
+      - id: shfmt
+        args: [-i, "2", -ci, -w]
+
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.18.4
+    hooks:
+      - id: gitleaks
+
+  - repo: https://github.com/adrienverge/yamllint
+    rev: v1.35.1
+    hooks:
+      - id: yamllint

home/.zshrc

@@ -61,14 +61,13 @@ h() {
   emulate -L zsh
   local selected src
   src=$(builtin fc -ln 1 2>/dev/null) || return
-  selected=$(printf '%s\n' "${(f)src}" | awk '{a[NR]=$0} END{for(i=NR;i>=1;i--)if(!seen[a[i]]++)print a[i]}' | peco) || return
+  selected=$(print -l -- "${(f)src}" | awk '{a[NR]=$0} END{for(i=NR;i>=1;i--)if(!seen[a[i]]++)print a[i]}' | peco) || return
   [[ -z "$selected" ]] && return
   print -s -- "$selected"
   echo "+ $selected"
   eval "$selected"
 }
 # hide typed 'h' line just before execution
-autoload -Uz add-zsh-hook
 hide_h_preexec() {
   if [[ "$1" == "h" ]]; then
     print -n -- $'\e[1A\e[2K\r'

install.sh

@@ -30,12 +30,12 @@ link() {
 should_skip() {
   local name="$1"
   case "$name" in
-    .|..) return 0 ;;
-    .DS_Store|.localized) return 0 ;;
-    .git|.gitignore|.gitattributes|.gitmodules) return 0 ;;
-    *.swp|*.swo|*~) return 0 ;;
-    .*.bak|.*.backup) return 0 ;;
-    .env|.env.*|*.secret) return 0 ;;
+    . | ..) return 0 ;;
+    .DS_Store | .localized) return 0 ;;
+    .git | .gitignore | .gitattributes | .gitmodules) return 0 ;;
+    *.swp | *.swo | *~) return 0 ;;
+    .*.bak | .*.backup) return 0 ;;
+    .env | .env.* | *.secret) return 0 ;;
     *) return 1 ;;
   esac
 }
@@ -67,7 +67,7 @@ if [[ -d "$DOTFILES_DIR/.ssh" ]]; then
     [[ -e "$f" ]] || continue
     name="$(basename "$f")"
     case "$name" in
-      config|known_hosts|*.pub)
+      config | known_hosts | *.pub)
         chmod 600 "$f"
         link "$f" "$HOME/.ssh/$name"
         ;;
@@ -87,7 +87,7 @@ if [[ -d "$DOTFILES_DIR/.gnupg" ]]; then
     [[ -e "$f" ]] || continue
     name="$(basename "$f")"
     case "$name" in
-      gpg-agent.conf|gpg.conf|pubring.kbx|sshcontrol)
+      gpg-agent.conf | gpg.conf | pubring.kbx | sshcontrol)
         link "$f" "$HOME/.gnupg/$name"
         ;;
       *)
@@ -156,7 +156,7 @@ setup_uv_completion() {
     "uv --generate-completion zsh" \
     "uv completions zsh"; do
     if output=$(eval "$cmd" 2>/dev/null) && [[ -n "$output" ]]; then
-      printf '%s\n' "$output" > "$out"
+      printf '%s\n' "$output" >"$out"
       log "Generated uv zsh completion: $out"
       return 0
     fi

scripts/install-homebrew.sh

@@ -9,5 +9,5 @@ fi
 
 echo "Installing Homebrew..."
 echo "This requires administrator privileges."
-sudo -v  # Prompt for password and cache credentials
+sudo -v # Prompt for password and cache credentials
 NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

scripts/setup-macos.sh

@@ -1,3 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
 defaults write com.apple.finder AppleShowAllFiles TRUE
 defaults write NSGlobalDomain AppleShowAllExtensions -bool true
 defaults write com.apple.finder QLEnableTextSelection -bool true
@@ -6,8 +9,8 @@ defaults write com.apple.driver.AppleBluetoothMultitouch.trackpad Clicking -bool
 defaults write com.apple.Preview NSQuitAlwaysKeepsWindows -bool false
 defaults write com.apple.dock autohide -bool true
 defaults write NSGlobalDomain NSNavPanelExpandedStateForSaveMode -boolean true
-defaults write com.apple.driver.AppleBluetoothMultitouch.trackpad TrackpadThreeFingerDrag -bool true && \
-defaults write com.apple.AppleMultitouchTrackpad TrackpadThreeFingerDrag -bool true
+defaults write com.apple.driver.AppleBluetoothMultitouch.trackpad TrackpadThreeFingerDrag -bool true &&
+  defaults write com.apple.AppleMultitouchTrackpad TrackpadThreeFingerDrag -bool true
 defaults write com.apple.dock static-only -bool true
 defaults write com.apple.TextEdit RichText -int 0
 sudo chflags nohidden /Volumes
@@ -18,9 +21,9 @@ defaults write com.apple.menuextra.clock DateFormat -string "M\u6708d\u65e5(EEE)
 defaults -currentHost write -globalDomain AppleFontSmoothing -int 2
 
 defaults write com.apple.systemuiserver menuExtras -array \
-    "/System/Library/CoreServices/Menu Extras/Bluetooth.menu" \
-    "/System/Library/CoreServices/Menu Extras/AirPort.menu" \
-    "/System/Library/CoreServices/Menu Extras/Battery.menu" \
-    "/System/Library/CoreServices/Menu Extras/Clock.menu"
+  "/System/Library/CoreServices/Menu Extras/Bluetooth.menu" \
+  "/System/Library/CoreServices/Menu Extras/AirPort.menu" \
+  "/System/Library/CoreServices/Menu Extras/Battery.menu" \
+  "/System/Library/CoreServices/Menu Extras/Clock.menu"
 
 killall Finder

tests/symlinks.bats

@@ -0,0 +1,31 @@
+#!/usr/bin/env bats
+
+@test ".zshrc is symlink" {
+  [ -L "$HOME/.zshrc" ]
+}
+
+@test ".zshrc points to dotfiles" {
+  run readlink "$HOME/.zshrc"
+  [[ "$output" == *"dotfiles/home/.zshrc"* ]]
+}
+
+@test ".zprofile is symlink" {
+  [ -L "$HOME/.zprofile" ]
+}
+
+@test ".gitconfig is symlink" {
+  [ -L "$HOME/.gitconfig" ]
+}
+
+@test "starship.toml is symlink" {
+  [ -L "$HOME/.config/starship.toml" ]
+}
+
+@test ".tigrc is symlink" {
+  [ -L "$HOME/.tigrc" ]
+}
+
+@test "install.sh is idempotent" {
+  ./install.sh
+  ./install.sh
+}