fix: git hooks

.github/workflows/codeql.yaml

@@ -66,21 +66,21 @@ jobs:
     steps:
       - id: checkout_repository
         name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           lfs: false
           submodules: recursive
 
       - id: codeql_init
         name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           source-root: ${{ env.GOHOME }}
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - id: codeql_analyze
         name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/devenv-update.yaml

@@ -61,7 +61,7 @@ jobs:
     steps:
       - id: checkout_repository
         name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           lfs: false
           submodules: recursive

.github/workflows/devenv.yaml

@@ -18,7 +18,6 @@ on:  # yamllint disable-line rule:truthy
       - devenv.nix
       - devenv.yaml
       - devenv.lock
-      - devenv/**
       - src/**
 
 concurrency:
@@ -66,7 +65,7 @@ jobs:
     steps:
       - id: checkout_repository
         name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           lfs: false
           submodules: recursive

.github/workflows/go.yaml

@@ -54,9 +54,8 @@ jobs:
       fail-fast: false
       matrix:
         go-version:
-          - "1.22"
-          - "1.23"
           - "1.24"
+          - "1.25"
         go-os:
           - "linux"
           - "darwin"
@@ -69,14 +68,14 @@ jobs:
     steps:
       - id: checkout_repository
         name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           lfs: false
           submodules: recursive
 
       - id: go_setup
         name: Set up Go (${{ matrix.go-version }})
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           check-latest: true
           go-version: ${{ matrix.go-version }}

.github/workflows/linter.yaml

@@ -43,7 +43,7 @@ jobs:
     steps:
       - id: checkout_repository
         name: Checkout repository with all history and tags
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         env:
           GITHUB_TOKEN: ${{ secrets.SUPER_LINTER_TOKEN }}
         with:

.github/workflows/nancy.yaml

@@ -63,16 +63,17 @@ jobs:
     steps:
       - id: checkout_repository
         name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           lfs: false
           submodules: recursive
 
-      - id: test_go_sum
-        name: Test for go.sum
+      - id: check_nancy
+        name: Check for Nancy run conditions
         shell: bash
         run: |
-          cd ${{ env.GOHOME }}
+          # Condition 1. We need a go.sum file.
+          pushd ${{ env.GOHOME }}
           if [ -f "go.sum" ];
           then
             echo "🔍 go.sum file present, running Nancy."
@@ -82,12 +83,26 @@ jobs:
             echo "🔍 No go.sum file present, skipping Nancy."
             echo "run_nancy=false" >> "$GITHUB_OUTPUT"
           fi
+          popd
+          # Condition 2. We need OSS Index username and token.
+          if [ "${{ vars.OSS_INDEX_USERNAME }}" != '' ] && [ "${{ secrets.OSS_INDEX_TOKEN }}" != '' ];
+          then
+            echo "🔍 OSS Index username and token present, running Nancy."
+            echo "run_nancy=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "🔍 OSS Index username or token missing, skipping Nancy."
+            echo "run_nancy=false" >> "$GITHUB_OUTPUT"
+          fi
 
       - id: run_nancy
         name: Run Nancy
-        if: ${{ steps.test_go_sum.outputs.run_nancy == 'true' }}
+        if: steps.check_nancy.outputs.run_nancy == 'true'
         uses: sonatype-nexus-community/nancy-github-action@main
         with:
           githubToken: ${{ secrets.GITHUB_TOKEN }}
           nancyVersion: latest
-          nancyCommand: sleuth --loud
+          nancyCommand: >-
+            sleuth
+            --username ${{ vars.OSS_INDEX_USERNAME }}
+            --token ${{ secrets.OSS_INDEX_TOKEN }}
+            --loud

.github/workflows/release.yaml

@@ -71,7 +71,7 @@ jobs:
 
       - id: checkout_repository
         name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           lfs: false
           submodules: none
@@ -119,7 +119,7 @@ jobs:
           ARTIFACT_FILE_1="${{ env.ARTIFACT_PATH }}/bin/${{ env.REPO_NAME }}"
           ARTIFACT_FILE_2="${{ env.ARTIFACT_PATH }}/bin/${{ matrix.goos }}_${{ matrix.goarch }}/${{ env.REPO_NAME }}"
 
-          mkdir -p artifacts          
+          mkdir -p artifacts
 
           if [[ -f "${ARTIFACT_FILE_1}" ]];
           then
@@ -185,7 +185,7 @@ jobs:
 
       - id: checkout_repository
         name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           lfs: false
           submodules: none
@@ -303,7 +303,7 @@ jobs:
 
       - id: create_release
         name: Create GitHub release
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         if: steps.check_version_bump.outputs.CREATE_RELEASE == 'true'
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -426,7 +426,7 @@ jobs:
     steps:
       - id: checkout_repository
         name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           lfs: false
           submodules: none

.github/workflows/trivy.yaml

@@ -74,7 +74,7 @@ jobs:
     steps:
       - id: checkout_repository
         name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           lfs: false
           submodules: recursive
@@ -115,7 +115,7 @@ jobs:
 
       - id: trivy_upload
         name: Trivy (upload)
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: "trivy-results.sarif"
 

devenv.lock

@@ -3,10 +3,10 @@
     "devenv": {
       "locked": {
         "dir": "src/modules",
-        "lastModified": 1755039979,
+        "lastModified": 1760560333,
         "owner": "cachix",
         "repo": "devenv",
-        "rev": "63db0a32cd767c2a9089fbaf24b0bb91c64c0652",
+        "rev": "0a4043938f540027e562c5a0feebbe6be872c3ea",
         "type": "github"
       },
       "original": {
@@ -57,10 +57,10 @@
         ]
       },
       "locked": {
-        "lastModified": 1754416808,
+        "lastModified": 1760392170,
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "9c52372878df6911f9afc1e2a1391f55e4dfc864",
+        "rev": "46d55f0aeb1d567a78223e69729734f3dca25a85",
         "type": "github"
       },
       "original": {
@@ -95,10 +95,10 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1754078208,
+        "lastModified": 1759991118,
         "owner": "nix-community",
         "repo": "gomod2nix",
-        "rev": "7f963246a71626c7fc70b431a315c4388a0c95cf",
+        "rev": "7f8d7438f5870eb167abaf2c39eea3d2302019d1",
         "type": "github"
       },
       "original": {
@@ -142,10 +142,10 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1755042551,
+        "lastModified": 1760608560,
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e4b54494cba4c82005d5fe3c0329a8f66fbfcff7",
+        "rev": "9c15c2a846a00eb6a98ac974b335ca7be2404311",
         "type": "github"
       },
       "original": {
@@ -155,32 +155,17 @@
         "type": "github"
       }
     },
-    "nixpkgs-unstable": {
-      "locked": {
-        "lastModified": 1754990257,
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "372d9eeeafa5b15913201e2b92e8e539ac7c64d1",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1754299112,
+        "lastModified": 1760346906,
         "owner": "cachix",
         "repo": "devenv-nixpkgs",
-        "rev": "16c21c9f5c6fb978466e91182a248dd8ca1112ac",
+        "rev": "0b429772c9c9b6f96cca629371a3150eb3cf862d",
         "type": "github"
       },
       "original": {
         "owner": "cachix",
-        "ref": "rolling",
+        "ref": "bump-rolling",
         "repo": "devenv-nixpkgs",
         "type": "github"
       }
@@ -193,7 +178,6 @@
         "mk-shell-bin": "mk-shell-bin",
         "nix2container": "nix2container",
         "nixpkgs": "nixpkgs_2",
-        "nixpkgs-unstable": "nixpkgs-unstable",
         "pre-commit-hooks": [
           "git-hooks"
         ]

devenv.nix

@@ -2,14 +2,13 @@
   pkgs,
   config,
   lib,
-  inputs,
   ...
 }:
 let
 
   # Variables
   name = "nixos-installer";
-  version = "0.1.5";
+  version = "0.1.6";
 
   # Custom packages.
   nixos-installer = import ./devenv/nixos-installer.nix {
@@ -20,16 +19,6 @@ let
     inherit pkgs;
   };
 
-  # All available unstable packages.
-  pkgsUnstable = import inputs.nixpkgs-unstable {
-    config.allowUnfree = true;
-  };
-
-  # Installed unstable packages.
-  unstablePackages = with pkgsUnstable; [
-    #golangci-lint
-  ];
-
   # Common stable packages.
   commonPackages = with pkgs; [
     figlet
@@ -74,7 +63,6 @@ in
 
   packages =
     commonPackages
-    ++ unstablePackages
     ++ lib.optionals (!config.container.isBuilding || config.name == "devenv") devPackages;
 
   enterShell = ''
@@ -105,14 +93,12 @@ in
 
   git-hooks = {
     excludes = [
-      ".cache"
-      ".devenv"
-      ".direnv"
-      "src/vendor"
+      "src/vendor/"
     ];
     hooks = {
       beautysh.enable = false;
       actionlint.enable = true;
+      action-validator.enable = true;
       check-merge-conflicts.enable = true;
       check-shebang-scripts-are-executable.enable = true;
       check-symlinks.enable = true;
@@ -166,8 +152,15 @@ in
   starship.enable = true;
 
   enterTest = ''
-    echo "Running tests"
+    echo -e "\nSTART: Running tests"
+
+    echo -e "\nTEST: Show git version"
     git --version | grep --color=auto "${pkgs.git.version}"
+
+    echo -e "\nTEST: Show nix-installer version"
+    nixos-installer --version
+
+    echo -e "\nEND: Running tests"
   '';
 
   scripts = {

devenv.yaml

@@ -2,9 +2,8 @@
 # yaml-language-server: $schema=https://devenv.sh/devenv.schema.json
 inputs:
   nixpkgs:
-    url: github:cachix/devenv-nixpkgs/rolling
-  nixpkgs-unstable:
-    url: github:nixos/nixpkgs/nixpkgs-unstable
+    #url: github:cachix/devenv-nixpkgs/rolling
+    url: github:cachix/devenv-nixpkgs/bump-rolling
   nix2container:
     url: github:nlewo/nix2container
     inputs:

scripts/yolo.sh

@@ -94,7 +94,7 @@ function detect_os() {
 	return 0
 }
 
-# shellcheck disable=SC2317
+# shellcheck disable=SC2317,SC2329
 function cleanup() {
 	msg "INFO" "🧹 Cleaning up temporary directory"
 	rm -rf "${TMP_DIR}" || {