Consolidate dotfiles improvements (Fish, tmux, CI, deps)

.chezmoi.toml.tmpl

@@ -1,9 +1,11 @@
 {{- $gitName := promptStringOnce . "git_name" "Git user.name for ~/.gitconfig_local" "" -}}
 {{- $gitEmail := promptStringOnce . "git_email" "Git user.email for ~/.gitconfig_local" "" -}}
 {{- $githubUser := promptStringOnce . "github_user" "GitHub username for [github] user in ~/.gitconfig_local" "" -}}
+{{- $machineName := promptStringOnce . "machine_name" "Machine name for ~/.name (prompts, tmux status)" .chezmoi.hostname -}}
 mode = "symlink"
 
 [data]
 git_name = {{ $gitName | quote }}
 git_email = {{ $gitEmail | quote }}
 github_user = {{ $githubUser | quote }}
+machine_name = {{ $machineName | quote }}

.chezmoiexternal.toml

@@ -1,45 +1,58 @@
 # Paths are home-relative (e.g. .vim/...) so clones follow ~/.vim → sourceDir/vim.
 # Vim: prefer vim-polyglot for syntax; keep vim-go (disable polyglot go); NERDTree = preservim fork.
+# Plugin versions are pinned via clone --branch so Renovate can bump them in this file.
 
 [".vim/pack/vendor/start/lightline.vim"]
 type = "git-repo"
 url = "https://github.com/itchyny/lightline.vim"
 refreshPeriod = "0"
+[".vim/pack/vendor/start/lightline.vim".clone]
+args = ["--branch", "master", "--depth", "1"]
 [".vim/pack/vendor/start/lightline.vim".pull]
 args = ["--ff-only"]
 
 [".vim/pack/vendor/start/nerdtree"]
 type = "git-repo"
 url = "https://github.com/preservim/nerdtree.git"
 refreshPeriod = "0"
+[".vim/pack/vendor/start/nerdtree".clone]
+args = ["--branch", "7.1.3", "--depth", "1"]
 [".vim/pack/vendor/start/nerdtree".pull]
 args = ["--ff-only"]
 
 [".vim/pack/vendor/start/vim-go"]
 type = "git-repo"
 url = "https://github.com/fatih/vim-go.git"
 refreshPeriod = "0"
+[".vim/pack/vendor/start/vim-go".clone]
+args = ["--branch", "v1.29", "--depth", "1"]
 [".vim/pack/vendor/start/vim-go".pull]
 args = ["--ff-only"]
 
 [".vim/pack/vendor/start/vim-polyglot"]
 type = "git-repo"
 url = "https://github.com/sheerun/vim-polyglot.git"
 refreshPeriod = "0"
+[".vim/pack/vendor/start/vim-polyglot".clone]
+args = ["--branch", "v4.17.0", "--depth", "1"]
 [".vim/pack/vendor/start/vim-polyglot".pull]
 args = ["--ff-only"]
 
 [".vim/pack/vendor/start/material.vim"]
 type = "git-repo"
 url = "https://github.com/kaicataldo/material.vim.git"
 refreshPeriod = "0"
+[".vim/pack/vendor/start/material.vim".clone]
+args = ["--branch", "main", "--depth", "1"]
 [".vim/pack/vendor/start/material.vim".pull]
 args = ["--ff-only"]
 
 [".vim/pack/vendor/start/incsearch.vim"]
 type = "git-repo"
 url = "https://github.com/haya14busa/incsearch.vim"
 refreshPeriod = "0"
+[".vim/pack/vendor/start/incsearch.vim".clone]
+args = ["--branch", "v2.0.1", "--depth", "1"]
 [".vim/pack/vendor/start/incsearch.vim".pull]
 args = ["--ff-only"]
 
@@ -48,12 +61,26 @@ args = ["--ff-only"]
 type = "git-repo"
 url = "https://github.com/zsh-users/zsh-syntax-highlighting.git"
 refreshPeriod = "0"
+[".zsh/plugins/zsh-syntax-highlighting".clone]
+args = ["--branch", "0.8.0", "--depth", "1"]
 [".zsh/plugins/zsh-syntax-highlighting".pull]
 args = ["--ff-only"]
 
 [".zsh/plugins/zsh-completions"]
 type = "git-repo"
 url = "https://github.com/zsh-users/zsh-completions.git"
 refreshPeriod = "0"
+[".zsh/plugins/zsh-completions".clone]
+args = ["--branch", "0.36.0", "--depth", "1"]
 [".zsh/plugins/zsh-completions".pull]
 args = ["--ff-only"]
+
+# Shell
+[".shell/plugins/nord-dircolors"]
+type = "git-repo"
+url = "https://github.com/nordtheme/dircolors.git"
+refreshPeriod = "0"
+[".shell/plugins/nord-dircolors".clone]
+args = ["--branch", "v0.2.0", "--depth", "1"]
+[".shell/plugins/nord-dircolors".pull]
+args = ["--ff-only"]

.github/renovate.json

@@ -0,0 +1,74 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    ":dependencyDashboard",
+    ":semanticCommits"
+  ],
+  "schedule": ["before 6am on monday"],
+  "labels": ["dependencies"],
+  "prConcurrentLimit": 5,
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Chezmoi git-repo externals pinned via clone --branch",
+      "managerFilePatterns": ["^\\.chezmoiexternal\\.toml$"],
+      "matchStrings": [
+        "\\[\"\\.(?<path>[^\"]+)\"\\][\\s\\S]*?url = \"https://github\\.com/(?<depName>[^/]+/[^/]+(?:\\.git)?)\"[\\s\\S]*?args = \\[\"--branch\", \"(?<currentValue>[^\"]+)\""
+      ],
+      "datasourceTemplate": "github-tags",
+      "versioningTemplate": "semver"
+    },
+    {
+      "customType": "regex",
+      "description": "Homebrew formulae in dot_Brewfile",
+      "managerFilePatterns": ["^dot_Brewfile$"],
+      "matchStrings": [
+        "^brew \"(?<depName>[a-z0-9][a-z0-9+@._/-]*)\"\\s*$"
+      ],
+      "datasourceTemplate": "repology",
+      "lookupNameTemplate": "homebrew/{{{depName}}}",
+      "versioningTemplate": "loose"
+    },
+    {
+      "customType": "regex",
+      "description": "Homebrew casks in dot_Brewfile",
+      "managerFilePatterns": ["^dot_Brewfile$"],
+      "matchStrings": [
+        "^cask \"(?<depName>[a-z0-9][a-z0-9+@._/-]*)\"\\s*$"
+      ],
+      "datasourceTemplate": "repology",
+      "lookupNameTemplate": "homebrew_casks/{{{depName}}}",
+      "versioningTemplate": "loose"
+    },
+    {
+      "customType": "regex",
+      "description": "Go tools installed via brew bundle go directive",
+      "managerFilePatterns": ["^dot_Brewfile$"],
+      "matchStrings": [
+        "^go \"(?<depName>[^\"]+)\"\\s*$"
+      ],
+      "datasourceTemplate": "go",
+      "versioningTemplate": "go"
+    }
+  ],
+  "packageRules": [
+    {
+      "description": "Group chezmoi external bumps",
+      "matchManagers": ["custom.regex"],
+      "matchFileNames": [".chezmoiexternal.toml"],
+      "groupName": "chezmoi externals"
+    },
+    {
+      "description": "Group Homebrew bundle updates",
+      "matchManagers": ["custom.regex"],
+      "matchFileNames": ["dot_Brewfile"],
+      "groupName": "homebrew bundle"
+    },
+    {
+      "description": "Group GitHub Actions",
+      "matchManagers": ["github-actions"],
+      "groupName": "github-actions"
+    }
+  ]
+}

.github/workflows/chezmoi.yml

@@ -0,0 +1,59 @@
+name: chezmoi
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+env:
+  CHEZMOI_VERSION: v2.71.0
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install chezmoi
+        run: |
+          mkdir -p "$HOME/.local/bin"
+          version="${CHEZMOI_VERSION#v}"
+          for attempt in 1 2 3; do
+            if curl -fsSL \
+              "https://github.com/twpayne/chezmoi/releases/download/v${version}/chezmoi_${version}_linux_amd64.tar.gz" \
+              -o /tmp/chezmoi.tar.gz; then
+              tar -xzf /tmp/chezmoi.tar.gz -C "$HOME/.local/bin" chezmoi
+              chmod +x "$HOME/.local/bin/chezmoi"
+              break
+            fi
+            sleep $((attempt * 5))
+          done
+          "$HOME/.local/bin/chezmoi" --version
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+      - name: Write test chezmoi config
+        run: |
+          mkdir -p "$HOME/.config/chezmoi"
+          cat > "$HOME/.config/chezmoi/chezmoi.toml" <<EOF
+          mode = "symlink"
+          sourceDir = "${{ github.workspace }}"
+          [data]
+          git_name = "CI User"
+          git_email = "ci@example.com"
+          github_user = "cibot"
+          machine_name = "ci"
+          EOF
+
+      - name: Render templates
+        run: |
+          set -euo pipefail
+          while IFS= read -r -d '' f; do
+            echo "Rendering ${f#./}"
+            chezmoi execute-template --init \
+              -c "$HOME/.config/chezmoi/chezmoi.toml" \
+              < "$f" > /dev/null
+          done < <(find . -name '*.tmpl' -not -path './.git/*' -print0)
+
+      - name: Dry-run apply
+        run: chezmoi apply --dry-run --verbose --refresh-externals=never

.github/workflows/dependency-audit.yml

@@ -0,0 +1,103 @@
+name: dependency-audit
+
+on:
+  schedule:
+    - cron: '0 8 * * 1'
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - .chezmoiexternal.toml
+      - dot_Brewfile
+      - .github/workflows/dependency-audit.yml
+
+jobs:
+  osv-scan-externals:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install osv-scanner
+        run: |
+          go install github.com/google/osv-scanner/v2/cmd/osv-scanner@v2.3.1
+          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+
+      - name: Clone pinned chezmoi externals
+        run: |
+          set -euo pipefail
+          mkdir -p /tmp/dotfiles-externals
+          python3 <<'PY'
+          import pathlib
+          import re
+          import subprocess
+
+          text = pathlib.Path(".chezmoiexternal.toml").read_text()
+          entries = re.findall(
+              r'\["([^"]+)"\]\s*\ntype = "git-repo"\s*\nurl = "([^"]+)"[\s\S]*?args = \["--branch", "([^"]+)"',
+              text,
+          )
+          for path, repo_url, branch in entries:
+              if repo_url.endswith(".git"):
+                  repo_url = repo_url[:-4]
+              name = path.replace("/", "_").lstrip(".")
+              dest = pathlib.Path("/tmp/dotfiles-externals") / name
+              print(f"Cloning {repo_url} @ {branch} -> {dest}")
+              subprocess.run(
+                  [
+                      "git", "clone", "--depth", "1",
+                      "--branch", branch,
+                      repo_url + ".git", str(dest),
+                  ],
+                  check=True,
+              )
+          PY
+
+      - name: Scan externals with OSV
+        run: |
+          # Drop test-only trees (e.g. vim-go fixtures) that produce stdlib noise.
+          find /tmp/dotfiles-externals -type d \( -name test-fixtures -o -name testdata -o -name tests \) -print0 \
+            | xargs -0 rm -rf
+          set +e
+          osv-scanner scan source --recursive /tmp/dotfiles-externals
+          code=$?
+          set -e
+          if [ "$code" -eq 128 ]; then
+            echo "No package manifests in externals; scan skipped."
+            exit 0
+          fi
+          exit "$code"
+
+  brew-outdated-report:
+    runs-on: macos-latest
+    continue-on-error: true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Report outdated Homebrew packages from dot_Brewfile
+        run: |
+          set -uo pipefail
+          brew update
+          {
+            echo "## Homebrew packages referenced in dot_Brewfile"
+            echo '```'
+            while read -r line; do
+              case "$line" in
+                brew\ \"*\"|cask\ \"*\")
+                  pkg=$(echo "$line" | sed -E 's/^(brew|cask) "([^"]+)".*/\2/')
+                  kind=$(echo "$line" | sed -E 's/^(brew|cask).*/\1/')
+                  if [ "$kind" = cask ]; then
+                    outdated=$(brew outdated --cask --quiet "$pkg" 2>/dev/null || true)
+                  else
+                    outdated=$(brew outdated --formula --quiet "$pkg" 2>/dev/null || true)
+                  fi
+                  if [ -n "$outdated" ]; then
+                    echo "OUTDATED $kind $pkg"
+                  else
+                    echo "current  $kind $pkg"
+                  fi
+                  ;;
+              esac
+            done < dot_Brewfile
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"