Add post-migration CI validation

.chezmoiroot

@@ -0,0 +1 @@
+home

.gitattributes

@@ -0,0 +1,2 @@
+* text=auto eol=lf
+*.cmd text eol=crlf

.github/workflows/validate.yml

@@ -0,0 +1,157 @@
+name: Validate dotfiles
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: validate-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  static:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Install validation tools
+        shell: bash
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends shellcheck
+          mkdir -p "$RUNNER_TEMP/bin"
+          curl -fsLS https://get.chezmoi.io | sh -s -- -b "$RUNNER_TEMP/bin"
+
+          actionlint_version=1.7.12
+          actionlint_archive="$RUNNER_TEMP/actionlint.tar.gz"
+          curl -fsSL "https://github.com/rhysd/actionlint/releases/download/v${actionlint_version}/actionlint_${actionlint_version}_linux_amd64.tar.gz" -o "$actionlint_archive"
+          echo "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8  $actionlint_archive" | sha256sum --check
+          tar -xzf "$actionlint_archive" -C "$RUNNER_TEMP/bin" actionlint
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+
+      - name: Validate workflow
+        run: actionlint .github/workflows/validate.yml
+
+      - name: Validate shell source
+        run: bash tests/static/validate-source.sh shell
+
+      - name: Validate chezmoi source
+        run: bash tests/static/validate-source.sh chezmoi
+
+      - name: Validate source architecture
+        run: python3 tests/static/validate-architecture.py
+
+      - name: Validate manifests
+        run: python3 tests/static/validate-manifests.py
+
+      - name: Validate encoded PowerShell bridge
+        run: python3 tests/static/check-powershell-bridge.py
+
+      - name: Validate PowerShell syntax
+        shell: pwsh
+        run: ./tests/static/validate-powershell.ps1
+
+  linux:
+    name: linux-${{ matrix.distro }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 35
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - distro: debian
+            image: debian:bookworm-slim
+          - distro: arch
+            image: archlinux:base
+    container:
+      image: ${{ matrix.image }}
+    steps:
+      - name: Prepare container
+        shell: sh
+        run: |
+          set -eu
+          case "${{ matrix.distro }}" in
+            debian) apt-get update; apt-get install --yes --no-install-recommends ca-certificates curl git sudo bash ;;
+            arch) pacman -Sy --noconfirm ca-certificates curl git sudo bash ;;
+          esac
+
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Exercise bootstrap and update
+        run: bash tests/linux/run-ci.sh "${{ matrix.distro }}" "$GITHUB_SHA"
+
+  windows:
+    runs-on: windows-2025
+    timeout-minutes: 45
+    env:
+      DOTFILES_NONINTERACTIVE: "1"
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - shell: pwsh
+        run: ./tests/windows/prepare-ci.ps1
+      - name: Run bootstrap
+        shell: cmd
+        run: |
+          mkdir "%RUNNER_TEMP%\dotfiles-run" 2>nul
+          pushd "%RUNNER_TEMP%\dotfiles-run"
+          call "%GITHUB_WORKSPACE%\bootstrap.cmd"
+          set "E=%ERRORLEVEL%"
+          popd
+          exit /b %E%
+      - shell: pwsh
+        run: ./tests/windows/assert-state.ps1 -RepoRoot $env:GITHUB_WORKSPACE -ExpectedCommit $env:GITHUB_SHA
+      - shell: cmd
+        run: call "%GITHUB_WORKSPACE%\tests\windows\create-update-fixture.cmd"
+      - shell: cmd
+        run: call "%GITHUB_WORKSPACE%\update.cmd"
+      - shell: pwsh
+        run: ./tests/windows/assert-state.ps1 -RepoRoot $env:GITHUB_WORKSPACE -UpdateMarker $env:UPDATE_MARKER
+
+  windows-allsigned:
+    runs-on: windows-2025
+    timeout-minutes: 50
+    env:
+      DOTFILES_NONINTERACTIVE: "1"
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - shell: pwsh
+        run: ./tests/windows/prepare-ci.ps1
+      - shell: pwsh
+        run: ./tests/windows/enable-allsigned.ps1
+      - shell: cmd
+        run: pwsh.exe -NoProfile -File "%RUNNER_TEMP%\allsigned-bridge-smoke.ps1" -Value bridge-ok
+      - name: Run bootstrap under AllSigned
+        shell: cmd
+        run: |
+          mkdir "%RUNNER_TEMP%\dotfiles-run" 2>nul
+          pushd "%RUNNER_TEMP%\dotfiles-run"
+          call "%GITHUB_WORKSPACE%\bootstrap.cmd"
+          set "E=%ERRORLEVEL%"
+          popd
+          exit /b %E%
+      - shell: cmd
+        run: call "%GITHUB_WORKSPACE%\scripts\windows\invoke-ps-script.cmd" "%GITHUB_WORKSPACE%\tests\windows\assert-allsigned.ps1" -RepoRoot "%GITHUB_WORKSPACE%" -ThumbprintFile "%RUNNER_TEMP%\dotfiles-cert-thumbprint.txt"
+      - shell: cmd
+        run: call "%GITHUB_WORKSPACE%\tests\windows\create-update-fixture.cmd"
+      - shell: cmd
+        run: call "%GITHUB_WORKSPACE%\update.cmd"
+      - shell: cmd
+        run: call "%GITHUB_WORKSPACE%\scripts\windows\invoke-ps-script.cmd" "%GITHUB_WORKSPACE%\tests\windows\assert-allsigned.ps1" -RepoRoot "%GITHUB_WORKSPACE%" -ThumbprintFile "%RUNNER_TEMP%\dotfiles-cert-thumbprint.txt" -UpdateMarker "%UPDATE_MARKER%"

.gitignore

@@ -1,10 +1,10 @@
 .vscode
 
 # Auto-generated files
-config/zsh/.zcompcache/*
-config/zsh/.zcompdump*
-config/zsh/.zhistory
-config/zsh/*/*.zwc
-config/zsh/.zsh_sessions/*
+home/dot_config/zsh/.zcompcache/*
+home/dot_config/zsh/.zcompdump*
+home/dot_config/zsh/.zhistory
+home/dot_config/zsh/*/*.zwc
+home/dot_config/zsh/.zsh_sessions/*
 
-fonts/
+fonts/

README.md

@@ -1,49 +1,56 @@
 # Dotfiles
 
-Welcome to my dotfiles! This repository contains configurations and scripts to quickly set up a development environment on Windows and Linux.
+This repository uses [chezmoi](https://www.chezmoi.io/) to deploy regular dotfiles on Windows and Linux. Repository support files stay outside the `home/` source state.
 
-## Quick Installation
+## Quick installation
 
-### 🖥️ Windows
+### Windows
 
-To set up your environment on Windows, run the following command in PowerShell:
+Run this from a normal `cmd.exe` prompt:
 
-```powershell
-Invoke-WebRequest -Uri "https://raw.githubusercontent.com/jsilverdev/dotfiles/main/lets-go.ps1" -OutFile ".\lets-go.ps1"; Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned; .\lets-go.ps1
+```cmd
+curl.exe -fsSLo "%TEMP%\dotfiles-bootstrap.cmd" https://raw.githubusercontent.com/jsilverdev/dotfiles/main/bootstrap.cmd && call "%TEMP%\dotfiles-bootstrap.cmd"
 ```
 
-To update installed applications and PowerShell modules:
+The Windows bootstrap requires WinGet. If App Installer exists but WinGet is not registered for the current user, it attempts current-user App Installer registration. If corporate policy disables WinGet, it stops with an error. Bootstrap installs only Git, PowerShell 7, and chezmoi when they are missing; the platform installer owns the remaining application catalog.
 
-```powershell
-.\install.ps1 -Update # or -u
-```
+Baseline CLI packages are declared in `scripts/windows/managed-apps.csv` and are installed with WinGet in user scope. An interactive run also installs workstation applications, fonts, Windows Terminal customization, and offers optional applications. `DOTFILES_NONINTERACTIVE=1` installs the complete baseline but skips those interactive/workstation customizations.
+
+The bootstrap does not require administrator rights or Developer Mode. It invokes PowerShell 7 with `-NoProfile`; an effective `AllSigned` policy is supported automatically. Each machine reuses or creates its own current-user Code Signing certificate and trusts its public certificate locally. No private key, PFX, or KeePass dependency is used.
 
-### 🐧 Linux
+### Linux
 
-To set up your environment on Linux, use this command:
+On Debian or Arch Linux, run:
 
 ```bash
-bash <(curl -s https://raw.githubusercontent.com/jsilverdev/dotfiles/main/lets-go.sh)
+bash <(curl -fsSL https://raw.githubusercontent.com/jsilverdev/dotfiles/main/bootstrap.sh)
 ```
 
-To refresh existing packages, pass `--update` (or `-u`):
+The bootstrap installs only the prerequisites required to obtain/apply the repository, installs chezmoi in `~/.local/bin` when needed, and then runs the package installer. Linux package catalogs are declared under `scripts/linux/`. Non-interactive mode still installs and validates the complete baseline; it only skips shell changes, WSL system configuration, and optional-package prompts. Arch continues to install and manage `yay`.
 
-```bash
-./install.sh --update
+## Updates
+
+For dotfiles-only updates, use:
+
+```text
+chezmoi update
 ```
 
-## Requirements
+For dotfiles plus installer-managed package/application/module updates, use `update.cmd` on Windows or `./update.sh` on Linux. Those wrappers run `chezmoi update` first and then rerun the platform installer in update mode. Starship and managed PowerShell modules participate in update mode as well.
+
+## State details
+
+- `home/.chezmoiroot` is represented by the repository-level `.chezmoiroot`, pointing to `home`.
+- Windows-only `.wslconfig` and Linux-only Zsh/Sheldon state are filtered by `home/.chezmoiignore`.
+- `~/.gitconfig.local`, `~/.codex/config.toml`, and `~/.codex/rules/default.rules` use chezmoi create-only semantics and are not overwritten after creation.
+- Codex guidance and skills are managed normally; repository documentation is kept outside `~/.codex`.
+- PowerShell source files are unsigned templates. The post-apply hook deploys copies and signs only the runtime files when `AllSigned` is effective, so Authenticode signatures never dirty chezmoi source state.
+- Managed PowerShell modules are declared in `scripts/windows/managed-modules.txt`. Under `AllSigned`, managed PowerShell files are re-signed with the locally trusted dotfiles certificate unless they already carry a valid signature from that same certificate. This deliberately normalizes the publisher used by the non-interactive AllSigned path.
 
-### 🖥️ Windows
-- PowerShell
-- [Dev Mode](https://learn.microsoft.com/en-us/windows/apps/get-started/enable-your-device-for-development) enabled
+## CI and testing
 
-### 🐧 Linux
-- Debian / Arch Linux
-- curl
+The `Validate dotfiles` workflow exercises Debian, Arch Linux, Windows with its normal execution policy, and Windows with a simulated current-user `AllSigned` policy. GitHub Actions only orchestrates the scenarios; reusable fixture and assertion logic lives under `tests/`.
 
-## Acknowledgments
+Integration jobs bootstrap from a temporary local bare Git remote containing the exact commit under test. They run the real non-interactive baseline, validate installed CLI tools, exercise create-only Codex files and update wrappers, check idempotent chezmoi apply, and verify clean source/checkout state. Static validation includes ShellCheck, PowerShell parsing, manifest checks, chezmoi template evaluation, bridge-payload synchronization, and pinned `actionlint` validation of the workflow.
 
-This dotfiles repository is inspired by:
-- [Lissy93's dotfiles](https://github.com/Lissy93/dotfiles)
-- [KEVINNITRO DOTFILES](https://github.com/KevinNitroG/dotfiles).
+The Windows AllSigned job validates current-user certificate creation and reuse, Authenticode signing, the CMD execution bridge, PowerShell profile startup, and managed module loading. When PowerShell 7 requires signed scripts, the bridge uses inbox Windows PowerShell only for Authenticode signing and executes the resulting signed script with PowerShell 7 under the effective policy. The hosted runner is an administrator with UAC disabled, so CI trusts the test certificate through `LocalMachine\Root` plus `CurrentUser\TrustedPublisher`; runtime helpers also accept `CurrentUser\Root` for the real non-admin path. Corporate GPO/MDM/AppLocker/WDAC policy, enterprise App Installer policy, and a true non-admin corporate Windows 11 token still require validation on a managed machine.

bootstrap.cmd

@@ -0,0 +1,114 @@
+@echo off
+setlocal EnableExtensions EnableDelayedExpansion
+
+if defined DOTFILES_REPO (
+    set "REPO_URL=%DOTFILES_REPO%"
+) else (
+    set "REPO_URL=https://github.com/jsilverdev/dotfiles.git"
+)
+where winget.exe >nul 2>&1
+if errorlevel 1 (
+    echo WinGet is not registered for this user. Attempting App Installer registration...
+    "%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "Add-AppxPackage -RegisterByFamilyName -MainPackage Microsoft.DesktopAppInstaller_8wekyb3d8bbwe"
+    if errorlevel 1 (
+        echo App Installer registration failed. WinGet may be disabled by corporate policy. 1>&2
+        goto bootstrap_failed
+    )
+)
+where winget.exe >nul 2>&1
+if errorlevel 1 (
+    echo WinGet is unavailable after App Installer registration. Check corporate policy or App Installer registration. 1>&2
+    goto bootstrap_failed
+)
+call :ensure_package Git.Git git
+if errorlevel 1 goto bootstrap_failed
+call :ensure_package Microsoft.PowerShell pwsh
+if errorlevel 1 goto bootstrap_failed
+call :ensure_package twpayne.chezmoi chezmoi
+if errorlevel 1 goto bootstrap_failed
+call :refresh_path
+where git.exe >nul 2>&1
+if errorlevel 1 (
+    echo Git is still unavailable after installation. 1>&2
+    goto bootstrap_failed
+)
+where pwsh.exe >nul 2>&1
+if errorlevel 1 (
+    echo PowerShell 7 is still unavailable after installation. 1>&2
+    goto bootstrap_failed
+)
+where chezmoi.exe >nul 2>&1
+if errorlevel 1 (
+    echo chezmoi is still unavailable after installation. 1>&2
+    goto bootstrap_failed
+)
+call :initialize_chezmoi
+if errorlevel 1 (
+    echo chezmoi initialization/update failed. 1>&2
+    goto bootstrap_failed
+)
+call :resolve_repo_root
+if not defined REPO_ROOT (
+    echo Unable to resolve the chezmoi working tree. 1>&2
+    goto bootstrap_failed
+)
+if not exist "%REPO_ROOT%\scripts\windows\invoke-ps-script.cmd" (
+    echo Resolved chezmoi working tree does not contain the dotfiles scripts: "%REPO_ROOT%" 1>&2
+    goto bootstrap_failed
+)
+if /I "%DOTFILES_NONINTERACTIVE%"=="1" (
+    call "%REPO_ROOT%\scripts\windows\invoke-ps-script.cmd" "%REPO_ROOT%\install.ps1" -NonInteractive -RepoRoot "%REPO_ROOT%"
+) else (
+    call "%REPO_ROOT%\scripts\windows\invoke-ps-script.cmd" "%REPO_ROOT%\install.ps1" -RepoRoot "%REPO_ROOT%"
+)
+if errorlevel 1 goto bootstrap_failed
+exit /b 0
+
+:bootstrap_failed
+exit /b 1
+
+:ensure_package
+set "PACKAGE_ID=%~1"
+set "PACKAGE_COMMAND=%~2"
+where "%PACKAGE_COMMAND%.exe" >nul 2>&1
+if not errorlevel 1 exit /b 0
+echo Installing %PACKAGE_ID% for the current user...
+winget.exe install --id "%PACKAGE_ID%" --exact --source winget --scope user --silent --disable-interactivity --accept-source-agreements --accept-package-agreements
+if errorlevel 1 (
+    echo Unable to install %PACKAGE_ID% without administrator rights. No machine-scope or portable fallback will be attempted. 1>&2
+    exit /b 1
+)
+exit /b 0
+
+:refresh_path
+set "PATH=%PATH%;%LOCALAPPDATA%\Microsoft\WinGet\Links;%LOCALAPPDATA%\Programs\Microsoft.PowerShell;%LOCALAPPDATA%\Programs\mise;%LOCALAPPDATA%\Programs\chezmoi"
+for /f "tokens=2,*" %%A in ('reg query HKCU\Environment /v Path 2^>nul ^| findstr /i "Path"') do set "PATH=!PATH!;%%B"
+exit /b 0
+
+:resolve_repo_root
+set "REPO_ROOT="
+if exist "%CD%\.chezmoiroot" if exist "%CD%\install.ps1" (set "REPO_ROOT=%CD%"& exit /b 0)
+for /f "delims=" %%R in ('chezmoi.exe execute-template "{{ .chezmoi.workingTree }}" 2^>nul') do set "REPO_ROOT=%%R"
+if defined REPO_ROOT if exist "%REPO_ROOT%\install.ps1" exit /b 0
+for /f "delims=" %%R in ('chezmoi.exe source-path 2^>nul') do set "SOURCE_ROOT=%%R"
+if defined SOURCE_ROOT if exist "%SOURCE_ROOT%\install.ps1" (set "REPO_ROOT=%SOURCE_ROOT%"& exit /b 0)
+if defined SOURCE_ROOT for %%P in ("%SOURCE_ROOT%\..") do if exist "%%~fP\install.ps1" (set "REPO_ROOT=%%~fP"& exit /b 0)
+exit /b 1
+
+:initialize_chezmoi
+if exist "%CD%\.chezmoiroot" (
+    chezmoi.exe --source "%CD%" apply
+    exit /b %ERRORLEVEL%
+)
+set "SOURCE_ROOT="
+for /f "delims=" %%R in ('chezmoi.exe source-path 2^>nul') do set "SOURCE_ROOT=%%R"
+if defined SOURCE_ROOT if exist "%SOURCE_ROOT%\.chezmoiroot" goto existing_chezmoi
+if defined SOURCE_ROOT for %%P in ("%SOURCE_ROOT%\..") do if exist "%%~fP\.chezmoiroot" goto existing_chezmoi
+chezmoi.exe init "%REPO_URL%"
+if errorlevel 1 exit /b %ERRORLEVEL%
+chezmoi.exe apply
+exit /b %ERRORLEVEL%
+
+:existing_chezmoi
+chezmoi.exe update
+exit /b %ERRORLEVEL%