Fix chezmoi version drift in install pipelines

[Copilot]

Renovate updates .chezmoiversion, but Windows/devcontainer pipelines could still use an older or unpinned chezmoi package. That caused chezmoi init to fail when source state required the newer version.

• Installer version enforcement

  • Read .chezmoiversion before running chezmoi init.
  • Compare any existing chezmoi binary against the required version.
  • Use package managers to install or upgrade a version that satisfies the requirement when missing or outdated.
  • Require .chezmoiversion for Unix installs so chezmoi installs remain pinned.
  • Accept both plain and v-prefixed chezmoi --version output.
  • Fail clearly with package-manager update guidance when the required version is not yet available.

• Cross-platform coverage

  • Added Unix handling in home/install.sh using mise and Homebrew package-manager paths.
  • Added Windows handling in home/install.ps1 using winget.
  • Refresh and reset winget sources when needed before package resolution.
  • Query the winget package version and install the available package version when it satisfies .chezmoiversion.
  • Pin .mise.toml chezmoi to the same version as .chezmoiversion and use it in devcontainer/CI install paths instead of chezmoi@latest.

• Renovate coverage

  • Keep .chezmoiversion updated via the existing Renovate custom manager.
  • Keep .mise.toml updated with an inline Renovate comment above the chezmoi version pin.

• Regression coverage

  • Added focused Bash tests for stale/current chezmoi install paths, unavailable package-manager versions, v-prefixed version output, .mise.toml pin alignment, Renovate coverage, and unpinned install-path prevention.
  • Extended PowerShell install tests for required-version handling, winget source refresh, package-version detection, and diagnostics.

Example behavior:

# .chezmoiversion requires 2.70.3
# Installed binary is 2.70.2

./home/install.sh
# tries package-manager installation/upgrade for 2.70.3
# exits with guidance if no package manager can provide it yet
# otherwise runs:
# chezmoi init --apply ...

[DevSecNinja]

@copilot I like to have things installed via the package managers instead of manually. Can't we just simply error out when the versions don't match and use e.g. --version from winget (https://learn.microsoft.com/en-us/windows/package-manager/winget/install#:~:text=%2Dv%2C%20%2D%2Dversion,highest%20versioned%20application.) to match the version number with .chezmoiversion? Then I just need to wait until the packages are up-to-date.

[Copilot]

@copilot I like to have things installed via the package managers instead of manually. Can't we just simply error out when the versions don't match and use e.g. --version from winget (https://...

Adjusted this to avoid the official release installer for required versions. Unix now tries package managers (mise/Homebrew) and errors with update guidance if they cannot provide the required version; Windows now uses winget --version and verifies the installed version before running chezmoi. Addressed in 9f0e0d5.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• dl.google.com
  • Triggering command: /usr/lib/apt/methods/https /usr/lib/apt/methods/https -T /home/REDACTED/wor--dummy-flag bash ts-exec-test --dummy-flag fig/shell/functi-T um -x -T bats bash odul�� r.gz.sha256 -T bash -x -T alidate-fish-con-q has_valid_syntax-b (dns block)
• eu-central-1-1.aws.cloud2.influxdata.com
  • Triggering command: /bin/curl /bin/curl --disable --cookie /dev/null --globoff --user-agent Linuxbrew/5.1.6 (Linux; x86_64 Ubuntu 24.04.4 LTS) curl/8.5.0 --header Accept-Language: en --fail --progress-bar --silent --retry 3 --max-time 3 --header Authorization: Token iVdsgJ_OjvTYGAA79gOfWlA_fX0QCuj4eYUNdb-qVUTrC3tp3JTWCADVNE9HxV0kp2ZjIK9tuthy_teX4szr9A== --header Content-Type: text/plain; charset=utf-8 (dns block)
• formulae.brew.sh
  • Triggering command: /bin/curl /bin/curl --disable --cookie /dev/null --globoff --user-agent Linuxbrew/5.1.6 (Linux; x86_64 Ubuntu 24.04.4 LTS) curl/8.5.0 --header Accept-Language: en --fail --progress-bar --silent --remote-time --output /home/REDACTED/.cache/Homebrew/api/formula_tap_migrations.jws.json --location --disable --cookie /dev/null --globoff (dns block)
  • Triggering command: /bin/curl /bin/curl --disable --cookie /dev/null --globoff --user-agent Linuxbrew/5.1.6 (Linux; x86_64 Ubuntu 24.04.4 LTS) curl/8.5.0 --header Accept-Language: en --fail --progress-bar --silent --remote-time --output /home/REDACTED/.cache/Homebrew/api/formula.jws.json --location --disable --cookie /dev/null --globoff (dns block)
  • Triggering command: /bin/curl /bin/curl --disable --cookie /dev/null --globoff --user-agent Linuxbrew/5.1.6 (Linux; x86_64 Ubuntu 24.04.4 LTS) curl/8.5.0 --header Accept-Language: en --fail --progress-bar --silent --remote-time --output /home/REDACTED/.cache/Homebrew/api/cask.jws.json --location --disable --cookie /dev/null --globoff (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[DevSecNinja]

@copilot Hmm, the pipeline is failing for winget but it's actually available:

winget find chezmoi
Name    Id              Version Source
---------------------------------------
chezmoi twpayne.chezmoi 2.70.3  winget

[Copilot]

@copilot Hmm, the pipeline is failing for winget but it's actually available:

...

The failing CI log showed winget could not open/update its source before it got to package resolution. I updated the installer to refresh/reset winget sources, query the documented winget search --id twpayne.chezmoi --exact --source winget --accept-source-agreements, and install the available winget version when it satisfies .chezmoiversion instead of pinning to an older exact version. Addressed in 5901add.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• dl.google.com
  • Triggering command: /usr/lib/apt/methods/https /usr/lib/apt/methods/https -T /home/REDACTED/wor--dummy-flag bash k/do�� --dummy-flag -T /snap/bin/bash -x -T bats bash les/�� ec2fY3O' && sha2-x -T tnet/tools/bash -x -T alidate-fish-con10 has_valid_syntax1 (dns block)
• eu-central-1-1.aws.cloud2.influxdata.com
  • Triggering command: /bin/curl /bin/curl --disable --cookie /dev/null --globoff --user-agent Linuxbrew/5.1.6 (Linux; x86_64 Ubuntu 24.04.4 LTS) curl/8.5.0 --header Accept-Language: en --fail --progress-bar --silent --retry 3 --max-time 3 --header Authorization: Token iVdsgJ_OjvTYGAA79gOfWlA_fX0QCuj4eYUNdb-qVUTrC3tp3JTWCADVNE9HxV0kp2ZjIK9tuthy_teX4szr9A== --header Content-Type: text/plain; charset=utf-8 (dns block)
• formulae.brew.sh
  • Triggering command: /bin/curl /bin/curl --disable --cookie /dev/null --globoff --user-agent Linuxbrew/5.1.6 (Linux; x86_64 Ubuntu 24.04.4 LTS) curl/8.5.0 --header Accept-Language: en --fail --progress-bar --silent --remote-time --output /home/REDACTED/.cache/Homebrew/api/cask.jws.json --location --disable --cookie /dev/null --globoff (dns block)
  • Triggering command: /bin/curl /bin/curl --disable --cookie /dev/null --globoff --user-agent Linuxbrew/5.1.6 (Linux; x86_64 Ubuntu 24.04.4 LTS) curl/8.5.0 --header Accept-Language: en --fail --progress-bar --silent --remote-time --output /home/REDACTED/.cache/Homebrew/api/cask_tap_migrations.jws.json --location --disable --cookie /dev/null --globoff (dns block)
  • Triggering command: /bin/curl /bin/curl --disable --cookie /dev/null --globoff --user-agent Linuxbrew/5.1.6 (Linux; x86_64 Ubuntu 24.04.4 LTS) curl/8.5.0 --header Accept-Language: en --fail --progress-bar --silent --remote-time --output /home/REDACTED/.cache/Homebrew/api/formula_tap_migrations.jws.json --location --disable --cookie /dev/null --globoff (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[DevSecNinja]

@copilot I need to figure out how Chezmoi versions get installed across the repo but also in my other repos. I know we have a .chezmoi version file, but are all tools pointing towards installing the version in that file, both in the devcontainer and in the installer? I noticed chezmoi@latest, that's not a great idea given we version pin it. We also need to make sure Renovate updates the versions in both/all places.

[Copilot]

@copilot I need to figure out how Chezmoi versions get installed across the repo but also in my other repos. I know we have a .chezmoi version file, but are all tools pointing towards installi...

Moved the .mise.toml Renovate tracking to an inline comment above the chezmoi pin and removed the extra .mise.toml custom manager. I also investigated the failing prebuild job: mise installed chezmoi@2.70.2, but the installer rejected the v2.70.2 version output, so I updated parsing to accept the v prefix and added coverage. Addressed in 57ba692.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• dl.google.com
  • Triggering command: /usr/lib/apt/methods/https /usr/lib/apt/methods/https -T /home/REDACTED/wor--dummy-flag bash ts-exec-test --dummy-flag -T /snap/bin/bash -x -T bats bash odul�� zC58KAM' && sha2-x -T tnet/tools/bash -x -T alidate-fish-con10 has_valid_syntax1 (dns block)
• eu-central-1-1.aws.cloud2.influxdata.com
  • Triggering command: /bin/curl /bin/curl --disable --cookie /dev/null --globoff --user-agent Linuxbrew/5.1.6 (Linux; x86_64 Ubuntu 24.04.4 LTS) curl/8.5.0 --header Accept-Language: en --fail --progress-bar --silent --retry 3 --max-time 3 --header Authorization: Token iVdsgJ_OjvTYGAA79gOfWlA_fX0QCuj4eYUNdb-qVUTrC3tp3JTWCADVNE9HxV0kp2ZjIK9tuthy_teX4szr9A== --header Content-Type: text/plain; charset=utf-8 (dns block)
• formulae.brew.sh
  • Triggering command: /bin/curl /bin/curl --disable --cookie /dev/null --globoff --user-agent Linuxbrew/5.1.6 (Linux; x86_64 Ubuntu 24.04.4 LTS) curl/8.5.0 --header Accept-Language: en --fail --progress-bar --silent --remote-time --output /home/REDACTED/.cache/Homebrew/api/formula.jws.json --location --disable --cookie /dev/null --globoff (dns block)
  • Triggering command: /bin/curl /bin/curl --disable --cookie /dev/null --globoff --user-agent Linuxbrew/5.1.6 (Linux; x86_64 Ubuntu 24.04.4 LTS) curl/8.5.0 --header Accept-Language: en --fail --progress-bar --silent --remote-time --output /home/REDACTED/.cache/Homebrew/api/formula_tap_migrations.jws.json --location --disable --cookie /dev/null --globoff (dns block)
  • Triggering command: /bin/curl /bin/curl --disable --cookie /dev/null --globoff --user-agent Linuxbrew/5.1.6 (Linux; x86_64 Ubuntu 24.04.4 LTS) curl/8.5.0 --header Accept-Language: en --fail --progress-bar --silent --remote-time --output /home/REDACTED/.cache/Homebrew/api/cask.jws.json --location --disable --cookie /dev/null --globoff (dns block)
• mise.run
  • Triggering command: /usr/bin/curl curl -fsSL REDACTED ol/linux_amd64/compile GOARCH_amd64 -D GOAMD64_v1 -o /tmp/go-build287036606/b049/hypot_amd64.o /home/REDACTED/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.10.linux-amd64/src/math/h�� (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)