bevry · balupton · May 22, 2025 · May 23, 2025 · May 23, 2025 · May 23, 2025
diff --git a/.github/workflows/dorothy-workflow.yml b/.github/workflows/dorothy-workflow.yml
@@ -83,7 +83,6 @@ jobs:
           setup-util-ksh
           setup-util-carapace
           dorothy --slug=${{ github.event.pull_request.head.repo.full_name || github.repository }} install
-          # nu -c 'echo $nu.loginshell-path'
       - name: 'Dorothy Login Shell: bash'
         shell: bash -leo pipefail {0}
         run: |
@@ -109,13 +108,7 @@ jobs:
           command-exists -- dorothy
           echo-style --success='ok'
       - name: 'Dorothy Login Shell: xonsh'
-        env:
-          PKG_CONFIG_PATH: '' # fix: https://github.com/bevry/dorothy/actions/runs/6349881708/job/17248752072#step:8:8
-          LDFLAGS: '' # fix: https://github.com/bevry/dorothy/actions/runs/6349927188/job/17248892389#step:8:9
-          CPPFLAGS: '' # fix: https://github.com/bevry/dorothy/actions/runs/6349956372/job/17248986621#step:8:10
-          CXX: '' # fix: https://github.com/bevry/dorothy/actions/runs/7538723888/job/20519802798#step:8:12
-          CC: '' #fix: https://github.com/bevry/dorothy/actions/runs/7538922544/job/20520381661#step:8:13
-        shell: xonsh -DXONSH_SHOW_TRACEBACK=True -l {0}
+        shell: xonsh -DXONSH_SHOW_TRACEBACK=True -DXONSH_TRACEBACK_LOGFILE=xonsh.log -l {0}
         run: |
           command-exists -- dorothy
           echo-style --success='ok'
@@ -146,7 +139,7 @@ jobs:
           # commit changes, if any
           cd "$DOROTHY"
           if git diff --quiet &>/dev/null; then
-            echo 'Already formatted.'
+            printf '%s\n' 'Already formatted.'
           else
             git config --global user.name 'Continuous Integration'
             git config --global user.email '[email protected]'
@@ -164,30 +157,56 @@ jobs:
       fail-fast: false
       matrix:
         runner:
+          # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#standard-github-hosted-runners-for-public-repositories
           - ubuntu-24.04
           - ubuntu-22.04
           - ubuntu-24.04-arm
           - ubuntu-22.04-arm
+          # - windows-2025 <-- windows changes the line endings in our source files, disrespecting our .gitattributes, so disable until that is fixed
+          # - windows-2022 <-- ^^
+          # - windows-11-arm <-- deno doesn't yet support windows arm
+          # macos tests are done later as they need their own bash handling
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - name: 'Dorothy Test'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # prevent rate limiting
+        shell: bash -leo pipefail {0}
+        run: |
+          # ensure dorothy is cloned, and run command
+          bash -c "$(curl -fsSL 'https://dorothy.bevry.me/run?slug=${{ github.event.pull_request.head.repo.full_name || github.repository }}&commit=${{ github.event.pull_request.head.sha || github.sha }}')" -- dorothy test
+  macos-test:
+    if: github.event_name == 'push' || ( github.event_name == 'pull_request' && toJson(github.event.pull_request.draft) == 'false' && toJson(github.event.pull_request.state) == '"open"' && toJson(github.event.pull_request.assignees) != '[]' )
+    strategy:
+      fail-fast: false
+      matrix:
+        runner:
+          - macos-26
           - macos-15
           - macos-14
-          - macos-13
+        bash:
+          - bash
+          - /bin/bash # this Bash 3.2 version actually behaves differently to GNU Bash 3.2 version
     runs-on: ${{ matrix.runner }}
     steps:
       - name: 'Dorothy Test'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # prevent rate limiting
         run: |
           # ensure dorothy is cloned, and run command
-          bash -c "$(curl -fsSL 'https://dorothy.bevry.me/run?slug=${{ github.event.pull_request.head.repo.full_name || github.repository }}&commit=${{ github.event.pull_request.head.sha || github.sha }}')" -- dorothy test
+          bash -c "$(curl -fsSL 'https://dorothy.bevry.me/run?slug=${{ github.event.pull_request.head.repo.full_name || github.repository }}&commit=${{ github.event.pull_request.head.sha || github.sha }}')" -- dorothy test --bash="${{ matrix.bash }}"
   fresh-macos-test:
     if: github.event_name == 'push' || ( github.event_name == 'pull_request' && toJson(github.event.pull_request.draft) == 'false' && toJson(github.event.pull_request.state) == '"open"' && toJson(github.event.pull_request.assignees) != '[]' )
     strategy:
       fail-fast: false
       matrix:
         runner:
+          - macos-26
           - macos-15
           - macos-14
-          - macos-13
+        bash:
+          - bash
+          - /bin/bash # this Bash 3.2 version actually behaves differently to GNU Bash 3.2 version
     runs-on: ${{ matrix.runner }}
     steps:
       - name: 'Uninstall Homebrew'
@@ -199,7 +218,33 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # prevent rate limiting
         run: |
           # ensure dorothy is cloned, and run command
-          bash -c "$(curl -fsSL 'https://dorothy.bevry.me/run?slug=${{ github.event.pull_request.head.repo.full_name || github.repository }}&commit=${{ github.event.pull_request.head.sha || github.sha }}')" -- dorothy test
+          bash -c "$(curl -fsSL 'https://dorothy.bevry.me/run?slug=${{ github.event.pull_request.head.repo.full_name || github.repository }}&commit=${{ github.event.pull_request.head.sha || github.sha }}')" -- dorothy test --bash="${{ matrix.bash }}"
+  all-bash-versions-test:
+    if: github.event_name == 'push' || ( github.event_name == 'pull_request' && toJson(github.event.pull_request.draft) == 'false' && toJson(github.event.pull_request.state) == '"open"' && toJson(github.event.pull_request.assignees) != '[]' )
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        bash:
+          - '3.2.57'
+          - '4.0'
+          # - '4.1' <-- see notes in `bash.bash`
+          # - '4.2.53' <-- see notes in `bash.bash`
+          # - '4.3.30' <-- see notes in `bash.bash`
+          - '4.4.18'
+          - '5.0'
+          - '5.1.16'
+          - '5.2.37'
+          - '5.3'
+          # This should match all versions known in `bash.bash` and include in `continue-on-error` the unsupported versions
+    steps:
+      - name: 'Dorothy Test'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # prevent rate limiting
+        continue-on-error: ${{ matrix.bash == '4.1' || matrix.bash == '4.2.53' || matrix.bash == '4.3.30' }}
+        run: |
+          # ensure dorothy is cloned, and run command
+          bash -c "$(curl -fsSL 'https://dorothy.bevry.me/run?slug=${{ github.event.pull_request.head.repo.full_name || github.repository }}&commit=${{ github.event.pull_request.head.sha || github.sha }}')" -- dorothy test --bash-version="${{ matrix.bash }}"
   container-test:
     if: github.event_name == 'push' || ( github.event_name == 'pull_request' && toJson(github.event.pull_request.draft) == 'false' && toJson(github.event.pull_request.state) == '"open"' && toJson(github.event.pull_request.assignees) != '[]' )
     runs-on: ubuntu-latest
@@ -210,10 +255,16 @@ jobs:
           - 'ubuntu:latest' # https://hub.docker.com/_/ubuntu
           - 'fedora:latest' # https://hub.docker.com/_/fedora
           - 'debian:latest' # https://hub.docker.com/_/debian
-          - 'alpine:latest' # https://hub.docker.com/_/alpine <-- script -qec workaround for TTY does not work on alpine
-          - 'opensuse/leap' # https://hub.docker.com/r/opensuse/leap <-- has outdated bash, so is good to test
-          - 'opensuse/tumbleweed' # https://hub.docker.com/r/opensuse/tumbleweed
-          - 'kalilinux/kali-rolling' # https://hub.docker.com/r/kalilinux/kali-rolling <-- apt based
+          - 'almalinux:latest' # https://hub.docker.com/_/almalinux
+          - 'openmandriva/minimal:rock' # https://hub.docker.com/r/openmandriva/minimal
+          - 'openmandriva/minimal:rolling' # https://hub.docker.com/r/openmandriva/minimal
+          - 'devuan/devuan:latest' # https://hub.docker.com/r/devuan/devuan
+          - 'opensuse/leap:latest' # https://hub.docker.com/r/opensuse/leap <-- has outdated bash, so is good to test
+          - 'opensuse/tumbleweed:latest' # https://hub.docker.com/r/opensuse/tumbleweed
+          - 'kalilinux/kali-rolling:latest' # https://hub.docker.com/r/kalilinux/kali-rolling <-- apt based
+          - 'ghcr.io/vanilla-os/pico:main' # https://github.com/vanilla-os/pico-image/pkgs/container/pico
+          # - 'ghcr.io/vanilla-os/core:latest' # https://github.com/Vanilla-OS/core-image/pkgs/container/core/544319268?tag=latest <-- too heavy for github actions, `failed to register layer: max depth exceeded`
+          # - 'alpine:latest' # https://hub.docker.com/_/alpine <-- deno currently broken: https://github.com/denoland/deno_install/issues/311 https://github.com/denoland/deno/issues/3711
           # - 'manjarolinux/base' # https://hub.docker.com/r/manjarolinux/base <-- broken due to https://gitlab.manjaro.org/packages/core/bash/-/issues/8 trying to remove it, trying to sync/refresh it, trying everything fails, as such disabled test, see all the failed CI attempts sinc: https://github.com/bevry/dorothy/actions/runs/7999660175/job/21847844816#step:3:84
           # - 'voidlinux/voidlinux' # https://hub.docker.com/r/voidlinux/voidlinux <-- locale failure, remote failure: https://github.com/bevry/dorothy/actions/runs/6622814794/job/17988863384
           # - 'mageia:cauldron' # https://hub.docker.com/_/mageia <-- cauldron is were moreutils is, disabled as couldn't get working

diff --git a/.gitignore b/.gitignore
@@ -12,3 +12,4 @@ basic.vim
 # custom to dorothy
 user
 state
+fixtures/*.actual.*
diff --git a/.trunk/configs/.shellcheckrc b/.trunk/configs/.shellcheckrc
@@ -1,7 +1,9 @@
 # https://github.com/trunk-io/configs
 enable=all
 source-path=SCRIPTDIR
-disable=SC2154,SC2164,SC2250,SC2310,SC2249,SC2312,SC1090,SC1091,SC2317,SC2016,SC2059
+# disabling external sources is necessary otherwise shellcheck will take forever due to the size of bash.bash
+external-sources=false
+disable=SC2154,SC2164,SC2250,SC2310,SC2249,SC2312,SC1090,SC1091,SC2317,SC2016,SC2059,SC1083,SC2329
 # https://www.shellcheck.net/wiki/SC2154 var is referenced but not assigned.
 # https://www.shellcheck.net/wiki/SC2164 Use cd ... || exit in case cd fails.
 # https://www.shellcheck.net/wiki/SC2250 Prefer putting braces around variable references even when not strictly required.
@@ -13,3 +15,5 @@ disable=SC2154,SC2164,SC2250,SC2310,SC2249,SC2312,SC1090,SC1091,SC2317,SC2016,SC
 # https://www.shellcheck.net/wiki/SC2317 Command appears to be unreachable. Check usage (or ignore if invoked indirectly).
 # https://www.shellcheck.net/wiki/SC2016 Expressions don't expand in single quotes, use double quotes for that.
 # https://www.shellcheck.net/wiki/SC2059 Don't use variables in the printf format string. Use printf "..%s.." "$foo".
+# https://www.shellcheck.net/wiki/SC1083 We use {...} in the same way exec does, for variable assignment
+# https://www.shellcheck.net/wiki/SC2329 We use eval, try, do, which shellcheck cannot figure out
diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml
@@ -1,18 +1,19 @@
-# https://features.trunk.io/check/p/trunk-doesnt-work-in-nested-repo
 version: 0.1
 cli:
-  version: 1.22.9
+  version: 1.25.0
 plugins:
   sources:
     - id: trunk
-      ref: v1.6.6
+      ref: v1.7.3
       uri: https://github.com/trunk-io/plugins
 runtimes:
   enabled:
-    - node@18.20.5
+    - node@22.16.0
     - [email protected]
     - [email protected]
-    # - [email protected] <-- there's only a single Node.js file: echo-url-coder.js
+  # The below disablement isn't yet supported: 'disabled' is not a recognized key
+  # disabled:
+  #   - node # There's only a single Node.js command: echo-url-coder.js
 actions:
   disabled:
     - trunk-announce
@@ -21,27 +22,28 @@ actions:
     - trunk-upgrade-available
 lint:
   enabled:
-    - [email protected]
-    - [email protected]
-    - [email protected]
-    - [email protected]
-    - [email protected]
-    - [email protected]
-    - git-diff-check@SYSTEM
-    - [email protected]
-    - [email protected]
-    - [email protected]
-    - [email protected]
-    - [email protected]
-    - [email protected]
-    - [email protected]
-    - [email protected]
-    - [email protected]
-    - [email protected]
+    - [email protected] # Validates GitHub Actions workflow syntax/logic
+    - [email protected] # Security linter for Python (finds common vulnerabilities)
+    - [email protected] # Opinionated Python code formatter
+    - [email protected] # Spell checker for code, comments, and docs
+    - [email protected] # Python style/lint checks (PEP8, bugs, complexity)
+    - git-diff-check@SYSTEM # Lightweight checks on changed diffs (e.g., conflict markers/forbidden patterns)
+    - [email protected] # Sorts & groups Python imports
+    - [email protected] # Lints Markdown style and formatting
+    - [email protected] # Formatter for JS/TS/JSON/CSS/Markdown/etc.
+    - [email protected] # Fast Python linter (rules from Flake8/pylint), optional formatter
+    - [email protected] # Static analysis for shell scripts (bash/sh)
+    - [email protected] # Shell script formatter
+    - [email protected] # TOML linter/formatter (e.g., pyproject.toml)
+    - [email protected] # YAML syntax and style checker
   disabled:
-    - eslint # it can't find the bevry config extensions for some reason
-    - trivy
-    - oxipng # broken for some reason on my mac mini
+    - eslint # It can't find the bevry config extensions for some reason
+    - oxipng # Broken for some reason on my mac mini
+    # We don't have any secrets in Dorothy, nor would secrets be applicable to Dorothy, so disable secret scanners as they will just slow linting down for no benefit.
+    - trivy # Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
+    - checkov # IaC security scanner (Terraform, CloudFormation, K8s, etc.)
+    - gitleaks # Secret scanner for commits and repos
+    - trufflehog # High-signal secret detector (entropy + pattern matches)
   ignore:
     - linters: [ALL]
       paths:
@@ -50,6 +52,31 @@ lint:
         - node_modules/**
         - commands.beta/pdf-extract
         - commands.beta/python-regex
+        - fixtures/*
     - linters: [trufflehog]
       paths:
         - commands/setup-util-warp
+    - linters: [checkov]
+      paths:
+        - config/installers.json
+    - linters: [shfmt]
+      paths:
+        - commands/setup-environment-commands
+        - commands/setup-git
+        - commands/setup-go
+        - commands/setup-hosts
+        - commands/setup-linux
+        - commands/setup-linux-raspi
+        - commands/setup-linux-recovery
+        - commands/setup-linux-safegraphics
+        - commands/setup-mac
+        - commands/setup-mac-appstore
+        - commands/setup-mac-brew
+        - commands/setup-node
+        - commands/setup-python
+        - commands/setup-ruby
+        - commands/setup-rust
+        - commands/setup-shell
+        - commands/setup-system
+        - commands/setup-util
+        - commands/setup-util-*
diff --git a/.vscode/extensions.json b/.vscode/extensions.json
@@ -14,6 +14,10 @@
     "trunk.io"
   ],
 
+  // List of extensions not needed but you will probably find useful:
+  // MS-vsliveshare.vsliveshare
+  // ms-vscode-remote.vscode-remote-extensionpack
+
   // List of extensions recommended by VS Code that should not be recommended for users of this workspace.
   "unwantedRecommendations": [
     "timonwong.shellcheck",

diff --git a/.vscode/settings.json b/.vscode/settings.json
@@ -10,7 +10,7 @@
   },
   "[plaintext][markdown][mdx]": {
     "editor.folding": false,
-    "editor.lineNumbers": "off",
+    "editor.lineNumbers": "on",
     "editor.minimap.enabled": false,
     "editor.renderControlCharacters": true,
     "editor.renderWhitespace": "boundary"

diff --git a/.vscode/workspace.code-workspace b/.vscode/workspace.code-workspace
@@ -10,8 +10,14 @@
     }
   ],
   "settings": {
+    // we use trunk, so disable these
     "prettier.enable": false,
-    "cSpell.enabled": true,
+    "cSpell.enabled": false,
+    // ensure our fixtures are text and not something special that gets formatted
+    "files.associations": {
+      "*.txt": "plaintext"
+    },
+    // if your deno server is failing, your deno version is likely outdated, run `setup-util-deno --upgrade`
     "deno.enable": true
   }
 }
-Original file line number
+Diff line change
@@ Expand Up / @@ -12,3 +12,4 @@ basic.vim @@
     # custom to dorothy
     user
     state
+    fixtures/*.actual.*