docs: humanize README, tighten copy and secrets docs #91
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Setup chezmoi | |
| run: | | |
| curl -fsLS https://github.com/twpayne/chezmoi/releases/latest/download/chezmoi-linux-amd64 -o chezmoi | |
| chmod +x chezmoi | |
| sudo mv chezmoi /usr/local/bin/ | |
| chezmoi --version | |
| - name: Lint shell scripts | |
| run: | | |
| find scripts/ -name "*.sh" -exec shellcheck {} \; | |
| - name: Check for template syntax errors | |
| run: | | |
| find . -name "*.tmpl" -o -name "*.conf" | xargs -I {} grep -l "{{.*}}" {} | while read file; do | |
| echo "Checking $file for template syntax..." | |
| # Skip SSH private key template as it requires personal flag and 1Password | |
| if [[ "$file" == *"private_id_rsa.tmpl" ]]; then | |
| echo "Skipping $file (requires personal flag and 1Password)" | |
| continue | |
| fi | |
| # Skip authorized_keys template as it requires GitHub API access | |
| if [[ "$file" == *"authorized_keys.tmpl" ]]; then | |
| echo "Skipping $file (requires GitHub API access)" | |
| continue | |
| fi | |
| # Skip Oh My Zsh template as it requires specific variables | |
| if [[ "$file" == *"oh-my-zsh.tmpl" ]]; then | |
| echo "Skipping $file (requires Oh My Zsh variables)" | |
| continue | |
| fi | |
| # Skip SSH public key template as it requires 1Password | |
| if [[ "$file" == *"id_rsa.pub.tmpl" ]]; then | |
| echo "Skipping $file (requires 1Password)" | |
| continue | |
| fi | |
| chezmoi execute-template --init --promptString email=test@example.com --promptString name=test --promptString personal=false < "$file" > /dev/null | |
| done | |
| test: | |
| runs-on: ubuntu-latest | |
| needs: lint | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Setup chezmoi | |
| run: | | |
| curl -fsLS https://github.com/twpayne/chezmoi/releases/latest/download/chezmoi-linux-amd64 -o chezmoi | |
| chmod +x chezmoi | |
| sudo mv chezmoi /usr/local/bin/ | |
| chezmoi --version | |
| - name: Run health check | |
| run: | | |
| # Mock environment for testing | |
| export HOME=/tmp/test-home | |
| mkdir -p $HOME | |
| # Try new location first, then legacy | |
| if [ -f ./utils/health-check.sh ]; then | |
| ./utils/health-check.sh || true | |
| elif [ -f ./scripts/utils/health-check.sh ]; then | |
| ./scripts/utils/health-check.sh || true | |
| fi | |
| - name: Test template generation | |
| run: | | |
| # Test template generation without actual creation | |
| ./scripts/utils/template-manager.sh list | |
| security: | |
| runs-on: ubuntu-latest | |
| needs: lint | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| scan-type: 'fs' | |
| scan-ref: '.' | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| - name: Display Trivy results | |
| run: | | |
| echo "=== Trivy Scan Results ===" | |
| if [[ -f trivy-results.sarif ]]; then | |
| echo "SARIF file generated successfully" | |
| echo "File size: $(wc -c < trivy-results.sarif) bytes" | |
| else | |
| echo "No SARIF file generated" | |
| fi | |
| - name: Upload Trivy scan results | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| continue-on-error: true |