Pin plugin archives and stop dfu auto-refresh

[hdp617]

Summary

Fixes review item #3: floating git-repo externals plus dfu always using --refresh-externals=always meant the next update could silently pull compromised vim/zsh plugin tips into the shell/editor.

Changes

• Convert all plugin externals in .chezmoiexternal.toml to commit-pinned archive URLs with checksum.sha256
• Install them under ~/.local/share/vim and ~/.local/share/zsh/plugins (archive externals conflict with symlink_dot_vim / symlink_dot_zsh if placed under ~/.vim / ~/.zsh)
• Point vim packpath and zsh plugin source/fpath at those paths
• dfu: --refresh-externals=never, fail if apply fails
• Add dfup: explicit refresh of the pinned archives after bumping commits/checksums
• Docs / .gitignore updated for the new layout

Migration

After apply, you can remove leftover clones from the old layout:

• ~/.vim/pack
• ~/.zsh/plugins/zsh-completions
• ~/.zsh/plugins/zsh-syntax-highlighting

Bumping a plugin later

1. Change the commit in the archive URL + checksum.sha256 in .chezmoiexternal.toml
2. Commit, then run dfup (or chezmoi apply --refresh-externals=always)

Test plan

• Downloaded each archive and recorded matching SHA-256
• chezmoi apply -R installed all six vim packs + both zsh plugins into a test dest
• Intentional checksum mismatch reports SHA256 mismatch
• On a real machine: chezmoi apply, confirm plugins load; dfu does not float upstream

  

[Copilot]

Pull request overview

This PR hardens plugin supply-chain handling by moving Vim/Zsh third-party plugins from floating git-repo externals to commit-pinned GitHub archive downloads verified by SHA-256, and by changing the default dotfiles update flow (dfu) to avoid auto-refreshing externals.

Changes:

• Convert Vim/Zsh plugin externals in .chezmoiexternal.toml to commit-pinned archive URLs with checksum.sha256, installed under ~/.local/share/....
• Update Vim/Zsh config to load plugins from the new ~/.local/share locations (Vim packpath, Zsh fpath and source paths).
• Update dotfiles update helpers and docs: dfu no longer refreshes externals; add dfup to explicitly refresh pinned archives.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
zsh/plugins_before.zsh	Point zsh-completions fpath at the new pinned archive location under ~/.local/share.
zsh/plugins_after.zsh	Source zsh-syntax-highlighting from the new pinned archive location under ~/.local/share.
shell/aliases.sh	Make dfu stop refreshing externals by default and fail on apply error; add dfup for explicit refresh.
README.md	Document the new pinned-archive approach, new install locations, and updated dfu/dfup behavior.
dot_vimrc	Prepend ~/.local/share/vim to packpath so Vim finds pinned pack plugins outside ~/.vim.
dot_config/fish/functions/dfup.fish	Add Fish dfup helper to force refresh of pinned externals.
dot_config/fish/functions/dfu.fish	Update Fish dfu to avoid external refresh by default and to fail on apply error.
.gitignore	Narrow ignore rules to leftover historical plugin clone paths (vim/pack, specific zsh plugin clone dirs).
.chezmoiexternal.toml	Switch externals to archive + pinned commit tarballs + SHA-256 checksums under ~/.local/share.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.