chore: initial release setup

.github/dependabot.yml

@@ -0,0 +1,9 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "dependencies"
+    open-pull-requests-limit: 10

.github/workflows/autofix.yml

@@ -0,0 +1,32 @@
+name: PR Autofix
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  autofix:
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+        with:
+          fetch-depth: 0
+      - name: CI setup (get-bashed)
+        run: ./scripts/ci-setup.sh "pre_commit,shdoc,actionlint,shellcheck,bashate"
+      - name: Run pre-commit
+        run: pre-commit run --all-files || true
+      - name: Detect changes
+        id: changed
+        uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891  # v47.0.1
+      - name: Commit fixes
+        if: steps.changed.outputs.any_modified == 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add -A
+          git commit -m "chore: apply pre-commit fixes [skip actions]" || exit 0
+          git push

.github/workflows/ci.yml

@@ -0,0 +1,27 @@
+name: CI
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+      - name: CI setup (get-bashed)
+        run: ./scripts/ci-setup.sh "shellcheck,actionlint,bashate,pre_commit,shdoc"
+      - name: Pre-commit
+        run: ./scripts/pre-commit-ci.sh
+  tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+      - name: CI setup (get-bashed)
+        run: ./scripts/ci-setup.sh "bats"
+      - name: Fetch Bats helpers
+        run: ./scripts/test-setup.sh
+      - name: Run tests
+        run: bats tests
+      - name: Verify install wiring
+        run: ./scripts/verify-install.sh

.github/workflows/dependabot-automerge.yml

@@ -0,0 +1,17 @@
+name: Dependabot Auto-merge
+on:
+  pull_request:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a  # v2.5.0
+      - uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d  # v3.0.0
+        with:
+          merge-method: squash

.github/workflows/docs.yml

@@ -0,0 +1,43 @@
+name: Docs
+on:
+  push:
+    branches: [ main ]
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: "pages"
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+      - name: CI setup (get-bashed)
+        run: ./scripts/ci-setup.sh "shdoc"
+      - name: Generate docs
+        run: ./scripts/gen-docs.sh
+      - name: Ensure landing page
+        run: |
+          if [[ ! -f docs/index.md ]]; then
+            cp docs/INDEX.md docs/index.md
+          fi
+      - name: Upload pages artifact
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b  # v4.0.0
+        with:
+          path: docs
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e  # v4.0.5

.github/workflows/pr-title.yml

@@ -0,0 +1,21 @@
+name: PR Title
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+jobs:
+  lint-title:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+      - name: Validate PR title
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          title="$PR_TITLE"
+          pattern='^(feat|fix|docs|style|refactor|perf|test|chore|ci|build|revert)(\([a-z0-9._-]+\))?: .+'
+          if [[ ! "$title" =~ $pattern ]]; then
+            echo "Invalid PR title: $title" >&2
+            echo "Expected Conventional Commit format, e.g., 'feat: add installer'." >&2
+            exit 1
+          fi

.github/workflows/release-please.yml

@@ -0,0 +1,16 @@
+name: Release Please
+on:
+  push:
+    branches: [ main ]
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38  # v4.4.0
+        with:
+          release-type: simple
+          exclude-paths: |
+            .github/**
+            docs/**
+            .pre-commit-config.yaml

.github/workflows/release.yml

@@ -0,0 +1,21 @@
+name: Release Artifacts
+on:
+  release:
+    types: [ published ]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+      - name: Package
+        run: ./scripts/package.sh dist "${GITHUB_REF_NAME}"
+      - name: Upload tarball
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5  # v1.0.2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          upload_url: ${{ github.event.release.upload_url }}
+          asset_path: dist/get-bashed-${{ github.ref_name }}.tar.gz
+          asset_name: get-bashed-${{ github.ref_name }}.tar.gz
+          asset_content_type: application/gzip

.gitignore

@@ -0,0 +1 @@
+tests/lib/

.pre-commit-config.yaml

@@ -0,0 +1,31 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.0
+    hooks:
+      - id: gitleaks
+  - repo: https://github.com/gruntwork-io/pre-commit
+    rev: v0.1.30
+    hooks:
+      - id: shellcheck
+  - repo: https://github.com/sirosen/check-jsonschema
+    rev: 0.36.1
+    hooks:
+      - id: check-github-workflows
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: detect-private-key
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+        exclude: ^docs/
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.10
+    hooks:
+      - id: actionlint
+  - repo: https://github.com/openstack/bashate
+    rev: 2.1.1
+    hooks:
+      - id: bashate
+        entry: bashate --ignore=E003,E006
+        files: ^(bin/.*|.*\\.(sh|bash)$)
+        exclude: ^tests/.*\\.bats$

.release-please-config.json

@@ -0,0 +1,6 @@
+{
+  "release-type": "simple",
+  "packages": {
+    ".": {}
+  }
+}

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.1.0"
+}