🩺 Audit fixes: CLI contracts, config safety, CI consolidation, docs & release status

.github/workflows/ci-macos.yml

@@ -1,4 +1,4 @@
-name: macOS CI - Bootstrap Test
+name: macOS CI
 
 on:
   pull_request:
@@ -7,56 +7,39 @@ on:
       - main
 
 jobs:
-  macos-bootstrap:
+  macos:
     runs-on: macos-latest
 
     steps:
-      # ----------------------------
-      # Checkout
-      # ----------------------------
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      # ----------------------------
-      # Ensure Homebrew exists
-      # ----------------------------
-      - name: Check Homebrew
+      - name: Cache Homebrew
+        uses: actions/cache@v4
+        with:
+          path: ~/Library/Caches/Homebrew
+          key: brew-${{ runner.os }}-${{ hashFiles('profiles/**/Brewfile') }}
+
+      - name: Ensure Homebrew
         run: |
           if ! command -v brew >/dev/null 2>&1; then
             echo "Homebrew not found (unexpected on macOS runner)"
             exit 1
           fi
+          brew update
+          brew analytics off
 
-      # ----------------------------
-      # Make scripts executable
-      # ----------------------------
       - name: Prepare scripts
         run: chmod +x scripts/*.sh
 
-      # ----------------------------
-      # Run bootstrap (MAIN TEST)
-      # ----------------------------
-      - name: Run setup script
-        run: |
-          ./scripts/setup.sh
+      - name: Verify setup CLI contract
+        run: bash scripts/cli.sh setup --profile minimal --dry-run
 
-      # ----------------------------
-      # Validate Brewfile
-      # ----------------------------
-      - name: Validate Brewfile
-        run: |
-          brew bundle check --file=profiles/full/Brewfile
+      - name: Install full profile
+        run: brew bundle --file=profiles/full/Brewfile
 
-      - name: Run bootstrap (real test)
-        run: |
-          chmod +x scripts/*.sh
-          ./scripts/setup.sh
+      - name: Apply setup once
+        run: CI=true bash scripts/setup.sh --profile full
 
-      - name: Re-run bootstrap (idempotence check)
-        run: |
-          ./scripts/setup.sh
-
-      - name: Validate Brew state
-        run: |
-          brew list
-          brew bundle check --file=profiles/full/Brewfile
+      - name: Verify setup and hardening
+        run: bash scripts/verify.sh

.github/workflows/ci.yml

@@ -18,6 +18,17 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Reject committed local artifacts
+        run: |
+          if git ls-files \
+            | grep -E '(^|/)\.DS_Store$|(^|/)logs/|\.log$'; then
+            echo "Local artifacts (.DS_Store, logs/, *.log) must not be committed."
+            exit 1
+          fi
+          echo "No committed local artifacts."
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -62,10 +73,35 @@ jobs:
             "$(find /tmp/lychee -type f -name lychee -print -quit)" \
             /usr/local/bin/lychee
 
-                    echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
 
-      - name: Check commit format
-        run: bash scripts/check-commit.sh
+      - name: Install Node dependencies
+        env:
+          HUSKY: "0"
+        run: npm ci
+
+      - name: Lint commit messages
+        env:
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PUSH_BEFORE_SHA: ${{ github.event.before }}
+          PUSH_AFTER_SHA: ${{ github.sha }}
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            from="$PR_BASE_SHA"
+            to="$PR_HEAD_SHA"
+          else
+            from="$PUSH_BEFORE_SHA"
+            to="$PUSH_AFTER_SHA"
+          fi
+
+          # First push of a branch reports an all-zero "before" SHA; fall back
+          # to the repository root so the range stays valid.
+          if printf '%s' "$from" | grep -Eq '^0+$'; then
+            from="$(git rev-list --max-parents=0 "$to" | tail -1)"
+          fi
+
+          npx --no -- commitlint --from "$from" --to "$to" --verbose
 
       - name: Cache pre-commit environments
         uses: actions/cache@v4
@@ -77,3 +113,8 @@ jobs:
 
       - name: Run repository quality checks
         run: pre-commit run --all-files --show-diff-on-failure
+
+      - name: Verify generated Zsh completion
+        run: |
+          bash scripts/generate-zsh-completion.sh
+          git diff --exit-code -- configs/zsh/completions/_mac

.husky/pre-commit

@@ -1 +1,4 @@
+#!/usr/bin/env sh
+
 npm test
+pre-commit run --all-files

Brewfile

@@ -0,0 +1 @@
+profiles/full/Brewfile