Add mise plugin infrastructure and security hardening#1
Open
sebastienrousseau wants to merge 20 commits into
Open
Add mise plugin infrastructure and security hardening#1sebastienrousseau wants to merge 20 commits into
sebastienrousseau wants to merge 20 commits into
Conversation
P0: Use mktemp for temp dir in firmware installer (TOCTOU fix) P0: Remove committed binary from git tracking P1: Scope pacman --overwrite to /usr/share/ollama/* only P1: Fix go.mod to use released Go 1.24 (was unreleased 1.25) P1: Extend CI ShellCheck and trigger paths to include workstation/ P1: Add .claude/settings.local.json to .gitignore P2: Remove duplicate *~ entry from .gitignore P2: Remove custom max() shadowing Go 1.21+ builtin P2: Replace sleep 2 with bounded readiness loop in thermal setup P2: Use non-recursive chown on fresh vault mount point P2: Use REAL_HOME instead of HOME in unmount-vault.sh for sudo compat Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
C1: Fix data race in Go installer — sync goroutine with WaitGroup before
reading stderrLog after cmd.Wait() returns
C2: Fix dd fallback creating ~60 EB sparse file — divide bytes by bs=1M
H1: Pin ludeeus/action-shellcheck to @2.0.0 (was @master)
H2: Validate boot order input with regex before passing to efibootmgr -o
H3: Quote $REAL_HOME in eval string in 99-verify-install.sh
H4: Replace su -c with runuser -l for AUR helper invocation
H5: Add SHA256 checksum verification for downloaded firmware package,
add security warning before curl|sudo bash in extraction guide
M1: Strip set -Eeuo pipefail (not just -euo) in test helper sed patterns
M2: Wrap all destructive ops in 03-optimise.sh with dryrun() — kernel
cmdline, sysctl, TLP config, systemd services, btrfs, pipewire, sleep
M3: Replace xargs with printf|tr -s for cmdline normalisation (preserves
quotes and backslashes)
M4: Gate background btrfs defragment behind DRY_RUN check
M5: Document intentional omission of -e in 99-verify-install.sh
M6: Run go mod tidy to clean stale go.sum entries
M7: Handle filepath.Abs error instead of discarding with _
M8: Add permissions: contents: read to tests.yml workflow
M9: Fix pacman -Sy to -S in workstation scripts (avoid partial upgrades)
M10: Fix task label from "Mounting /root/Code" to "Mounting ~/Code"
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add --help/-h flag to 6 scripts missing usage information (L1) - Correct unit test counts in README and changelog to 148 (L2) - Reconcile versioning across SECURITY.md, changelog, and VitePress config (L6) - Add 5 workstation Makefile targets with DRY_RUN support (L9) - Document bootstrap-dotfiles.sh trust model in SECURITY.md (L10) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add 26 unit tests for all 5 workstation scripts (L3) - Expand integration tests with dry-run coverage for core and workstation scripts (L4) - Update Dockerfiles to include workstation/ directory - Add WORKSTATION_DIR to test_helper.bash - Update test count to 174 in README and changelog Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
… droid-factory)
Introduces version-managed AI tool installation via mise plugins, replacing
ad-hoc pacman/pipx installs with reproducible, version-pinned tooling.
New files:
- mise-plugins/{ollama,claude-code,droid-factory}/bin/{list-all,download,install}
- workstation/50-mise-plugins.sh with register_and_install loop and WSL detection
- 56 new unit tests across 4 test files (230 total, 100% branch coverage)
- docs/workstation/50-mise-plugins.md with architecture detection matrix
- .dockerignore to reduce Docker build context
Updated: Makefile, README, CONTRIBUTING (signed commits, strict mode, lint scope),
Dockerfiles, integration runner, VitePress sidebar and changelog.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace GNU-only grep -oP (Perl regex) with portable grep -oE pipeline in ollama list-all, add .gitattributes for LF line-ending enforcement, pin Dockerfiles to linux/amd64 platform, and expand CI to run unit tests on macOS alongside Ubuntu with mise-plugin path triggers. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace all grep -oP (GNU Perl regex) with portable grep -oE + sed in bootloader and optimise scripts. Replace grep -cP in emoji-detection tests with perl -CSD for macOS compatibility. Add missing numfmt mock in create_image test. Run thermal-setup integration test with sudo. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Wrap mbpfan AUR installation with dryrun() and gracefully handle missing paru/yay in dry-run mode instead of exiting with error. Fixes integration test failure in Docker where no AUR helper exists. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Wrap mbpfan AUR installation, systemctl enable/restart, and service status check with dryrun() guards. Gracefully handles missing paru/yay and mbpfan.service in dry-run mode. Fixes integration test failure in Docker containers where no AUR helper or systemd services exist. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
P0: Update changelog test count (174→230) and workstation count (5→6). P1: Standardise `sudo make install` across guide pages, fix `modprobe apple-bce` → `apple_bce`, add Usage section to 00-system-init.md, fix SECURITY.md changelog link for GitHub. P2: Align all 7 core scripts to `set -Eeuo pipefail` per CONTRIBUTING convention, clarify gitignored installer_bin in README tree. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…erage - Add workstation/05-desktop-base.sh: GNOME, GDM, NetworkManager, fonts, fwupd, intel-ucode, pacman-contrib, fstrim/paccache timers, bluetooth - Add scripts/08-maintenance.sh: system upgrade, T2 health, SSD TRIM, package cache cleanup, orphan removal, journal vacuum, Limine integrity, git signing readiness - Enhance installer/main.go: weighted progress bar, T2 hardware pre-flight check (apple_bce), executable-relative path resolution, 16 tasks - Expand installer/main_test.go: 40+ tests, Go coverage 97.2% - Add CI jobs: Go unit tests, Gitleaks secret scanning, ShellCheck -x flag - Add scripts/03-optimise.sh: i915 GUC/HUC, RTC UTC, mirror ranking - Enhance scripts/99-verify-install.sh: desktop foundation checks, auto-fix - Add 300 BATS tests (was 230) covering all exported shell functions - Update docs, Makefile, README, VitePress sidebar for new scripts Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add PipeWire audio section (pipewire, pipewire-pulse, wireplumber) - Fix fwupd service enable to use explicit fwupd.service - Fix paccache.timer check to use grep instead of list-unit-files arg - Fix bluez check to test packages individually (pacman -Qq one at a time) - Remove bogus `command -v gdm` check (gdm has no CLI binary) - Add xdg-user-dirs-update call after package install - Fix header comment filename (09 -> 05) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Split monolithic test_helper.bash into modular layers: - helpers/: common setup, mock_pacman, mock_systemctl, assertions DSL, mock_mise_plugin (deduplicating 99 lines across 3 mp-*.bats files) - contracts/: reusable test patterns for standards, package install, service enable, dry-run, summary, and mise plugin env checks - test_helper.bash becomes a thin loader sourcing all modules Refactored 17 .bats files to use contracts and DSL assertions. All 303 tests pass unchanged. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Documents when to use contracts vs script-specific tests, how to add new mocks/helpers/contracts, and how to avoid duplicating patterns. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…rrency - Replace per-package pacman -Qq forks with single batch query + associative array lookups in 00-system-init, 03-optimise, 99-verify - Add 24h TTL cache for mirror ranking in 00-system-init, 08-maintenance - Fix vm.swappiness 10→133 (correct for ZRAM compressed swap) - Fix dirty_writeback/expire 6000→1500 (better NVMe responsiveness) - Remove autodefrag from BTRFS recommendations (write amplification) - Remove pcie_aspm=off from kernel cmdline (saves 10-15% battery) - Set TLP PCIE_ASPM_ON_BAT=powersupersave for per-device management - Replace unbounded strings.Builder with fixed-size ring buffer (100 lines) - Replace sequential io.MultiReader with concurrent stdout/stderr goroutines - Resolve projectRoot once in newModel() instead of per-task - Fix Dockerfile.unit: add missing helpers/ and contracts/ COPY directives Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…y gaps - Remove pcie_aspm=off from kernel params tables (guide, scripts) - Update sysctl values: swappiness 10→133, writeback 6000→1500 - Remove autodefrag from BTRFS fstab recommendations (guide, partition-layout) - Update TLP ASPM description to powersupersave on battery - Add batch pacman query and 24h mirror TTL to script docs - Add v0.0.2 changelog entry and RSS feed entry - Update test count 230→303 in README - Fix set -euo → set -Eeuo in SECURITY.md and scripts overview Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The banner SVG was transparent with a Gaussian blur shadow filter, making it invisible and blurry on light backgrounds. Adds a dark (#1e1e2e) rounded background so the banner renders crisply in both light and dark modes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…pies Apply the same fix to root banner.svg/banner.png and docs/public/banner.svg. Adds a dark (#1e1e2e) rounded background and removes the Gaussian blur shadow filter so the banner renders crisply on both light and dark backgrounds. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ed JSON-LD - Expand workstation/00-ai-dev-workstation.md with package table, pipx/npm tools, and container runtime details - Expand workstation/40-dotfiles-link.md with mappings table, safety details, and extension example - Create VerifiedOn.vue component rendered via doc-after layout slot - Add dateVerified to TechArticle JSON-LD schemas when verifiedOn is present - Add verifiedOn: 2026-04-01 frontmatter to 32 guide/scripts/workstation pages Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…cess tests - Replace mapfile in orphan_removal with while-read loop (bash 3.2 compat) - Tests 157/158: use direct function call with restricted PATH instead of spawning a bash subprocess (avoids macOS /usr/bin/bash 3.2 issues) - Test 169: use assert_mock_called_with instead of raw grep Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
50-mise-plugins.shwithregister_and_installloop, WSL browser-auth detection,--dry-runand--helpsupport.dockerignore, strict mode fix (-Eeuo), lint scope expansionChanges
New files (16)
mise-plugins/{ollama,claude-code,droid-factory}/bin/{list-all,download,install}— 9 plugin scriptsworkstation/50-mise-plugins.sh— workstation provisioning moduletests/{mp-ollama,mp-claude-code,mp-droid-factory,w50-mise-plugins}.bats— 4 test filesdocs/workstation/50-mise-plugins.md— VitePress documentation.dockerignore— reduces Docker build contextModified files (8)
Makefile—mise-pluginstarget, shellcheck scopeREADME.md— directory tree, workstation table, test countCONTRIBUTING.md— signed commits, strict mode, lint scopedocs/.vitepress/config.mjs— sidebar entry, changelog accuracydocs/workstation/overview.md— corrected integration sectiontests/Dockerfile.{unit,integration}— COPY mise-pluginstests/integration/run-all.sh— mise-plugins dry-run testTest plan
shellcheck mise-plugins/*/bin/* workstation/*.sh scripts/*.sh— cleanbats tests/*.bats— 230/230 passbash workstation/50-mise-plugins.sh --dry-run— completes without error🤖 Generated with Claude Code