From 63abed5da4a1576797126c5e0671772e7be7572c Mon Sep 17 00:00:00 2001 From: Drew Robinson Date: Thu, 20 Aug 2026 21:41:02 +1000 Subject: [PATCH 1/7] ci: pin Bun runtime to 1.3.14 in docs deploy workflow The workflow used bun-version: latest, leaving the build runtime unpinned while every action around it is pinned to a commit SHA. Pin to 1.3.14 to match local development and keep builds reproducible. --- .github/workflows/deploy-docs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml index 6c48d4a..fc6c3df 100644 --- a/.github/workflows/deploy-docs.yml +++ b/.github/workflows/deploy-docs.yml @@ -25,7 +25,7 @@ jobs: - name: Setup Bun uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: - bun-version: latest + bun-version: 1.3.14 - name: Setup Pages if: github.event_name != 'pull_request' From 2743922d5c099c3af0611bd87b35daf0ccc86010 Mon Sep 17 00:00:00 2001 From: Drew Robinson Date: Thu, 20 Aug 2026 21:41:06 +1000 Subject: [PATCH 2/7] ci: deny default workflow permissions in docs deploy workflow zizmor flagged excessive-permissions: the workflow declared per-job permissions but had no workflow-level default, so it inherited the runner default. Both jobs already declare what they need, so denying by default at the top level costs nothing. --- .github/workflows/deploy-docs.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml index fc6c3df..bc8e8f7 100644 --- a/.github/workflows/deploy-docs.yml +++ b/.github/workflows/deploy-docs.yml @@ -7,6 +7,8 @@ on: branches: ["main"] workflow_dispatch: +permissions: {} + concurrency: group: "docs-${{ github.ref }}" cancel-in-progress: true From 55dd151ea095ca43bce8a632466939d13f5138e2 Mon Sep 17 00:00:00 2001 From: Drew Robinson Date: Thu, 20 Aug 2026 21:41:12 +1000 Subject: [PATCH 3/7] ci(security): run zizmor via pinned official action Replace the hand-rolled "pip install zizmor && zizmor ." step with zizmorcore/zizmor-action pinned to v0.6.2 (bundles zizmor 1.29.0). The pip install was unpinned, making the security scanner the one unpinned link in an otherwise SHA-pinned chain. Results also went nowhere with only contents: read, so add security-events: write to upload SARIF to code scanning. --- .github/workflows/zizmor.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 60eba66..2bdfbe1 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -12,6 +12,9 @@ jobs: zizmor: runs-on: ubuntu-latest permissions: + # Required to upload zizmor's SARIF results to code scanning. + security-events: write + # Required to check out the repository contents. contents: read steps: - name: Checkout repository @@ -20,4 +23,4 @@ jobs: persist-credentials: false - name: Run zizmor 🌈 - run: pip install zizmor && zizmor . + uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 From c766eb715ed6cf62a7a0e56408cd0462ea0f76a9 Mon Sep 17 00:00:00 2001 From: Drew Robinson Date: Thu, 20 Aug 2026 21:41:19 +1000 Subject: [PATCH 4/7] chore: ignore local .artifacts directory --- .gitignore | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.gitignore b/.gitignore index 6240da8..ef06b26 100644 --- a/.gitignore +++ b/.gitignore @@ -19,3 +19,6 @@ pnpm-debug.log* # macOS-specific files .DS_Store + +# Generated artifacts from exploration and testing. +/.artifacts/ From ea20b5c2f77a5da1d4431c43f037439fe10c53eb Mon Sep 17 00:00:00 2001 From: Drew Robinson Date: Fri, 21 Aug 2026 17:05:40 +1000 Subject: [PATCH 5/7] docs: support armv7/armv6 in Linux install command v3.0.0 publishes ahoy-bin-linux-armv7 and ahoy-bin-linux-armv6 alongside amd64 and arm64, but the install one-liner only detected the latter two. Add cases for both, and match armv8* to arm64. Also replace the "*) echo amd64" catch-all with an explicit error. Previously an unrecognised machine silently downloaded the amd64 binary, which then failed to execute; it now aborts before wget with a clear message rather than installing an unusable binary. Patterns are parenthesised so the case survives zsh command substitution; verified the one-liner parses under sh, bash, zsh and dash. --- src/content/docs/guides/getting-started.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/guides/getting-started.mdx b/src/content/docs/guides/getting-started.mdx index bf41b25..5e880e5 100644 --- a/src/content/docs/guides/getting-started.mdx +++ b/src/content/docs/guides/getting-started.mdx @@ -16,7 +16,7 @@ import { Aside } from "@astrojs/starlight/components"; ```bash - os=$(uname -s | tr '[:upper:]' '[:lower:]') && architecture=$(case $(uname -m) in x86_64 | amd64) echo "amd64" ;; aarch64 | arm64 | armv8) echo "arm64" ;; *) echo "amd64" ;; esac) && sudo wget -q https://github.com/ahoy-cli/ahoy/releases/latest/download/ahoy-bin-$os-$architecture -O /usr/local/bin/ahoy && sudo chown $USER /usr/local/bin/ahoy && chmod +x /usr/local/bin/ahoy + os=$(uname -s | tr '[:upper:]' '[:lower:]') && architecture=$(case $(uname -m) in (x86_64 | amd64) echo "amd64" ;; (aarch64 | arm64 | armv8*) echo "arm64" ;; (armv7*) echo "armv7" ;; (armv6*) echo "armv6" ;; esac) && { [ -n "$architecture" ] || { echo "Unsupported architecture: $(uname -m)" >&2; false; }; } && sudo wget -q https://github.com/ahoy-cli/ahoy/releases/latest/download/ahoy-bin-$os-$architecture -O /usr/local/bin/ahoy && sudo chown $USER /usr/local/bin/ahoy && chmod +x /usr/local/bin/ahoy ``` Or download the [latest release from GitHub](https://github.com/ahoy-cli/ahoy/releases) and place the binary somewhere in your `$PATH`. From 423637fd5e926e119c3acee85591918a31970f8c Mon Sep 17 00:00:00 2001 From: Drew Robinson Date: Fri, 21 Aug 2026 17:35:17 +1000 Subject: [PATCH 6/7] docs: note that Homebrew now installs v3, and how to get v2 homebrew-core moved the ahoy formula to 3.0.0, so brew install ahoy no longer yields v2. The Linux one-liner is affected too, since it downloads from /releases/latest/. Add an aside to the installation section covering both: v3 is intended to be backwards compatible with existing v2 .ahoy.yml files, and anyone who still needs v2 should take v2.5.0 from the GitHub releases page. There is no ahoy@2 formula, so that is the only route to v2 on macOS as well as Linux. Note the v2 assets are named differently to v3 (ahoy-bin-linux-arm rather than the armv6/armv7 split), so the pinned-tag URL is given rather than reusing the command above. --- src/content/docs/guides/getting-started.mdx | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/src/content/docs/guides/getting-started.mdx b/src/content/docs/guides/getting-started.mdx index 5e880e5..59f5a2d 100644 --- a/src/content/docs/guides/getting-started.mdx +++ b/src/content/docs/guides/getting-started.mdx @@ -27,6 +27,22 @@ import { Aside } from "@astrojs/starlight/components"; + + Verify it's working: ```bash From 5760e6f7965c9316fd1b90f8e0279d96a90d4547 Mon Sep 17 00:00:00 2001 From: Drew Robinson Date: Fri, 21 Aug 2026 18:02:31 +1000 Subject: [PATCH 7/7] (chore) Adjust v2 message --- src/content/docs/guides/getting-started.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/guides/getting-started.mdx b/src/content/docs/guides/getting-started.mdx index 59f5a2d..1e5f76d 100644 --- a/src/content/docs/guides/getting-started.mdx +++ b/src/content/docs/guides/getting-started.mdx @@ -33,7 +33,7 @@ import { Aside } from "@astrojs/starlight/components"; v3 is intended to be fully backwards compatible with existing v2 `.ahoy.yml` files, so most projects need no changes. If you do still need v2, download it from the - [v2.5.0 release page](https://github.com/ahoy-cli/ahoy/releases/tag/v2.5.0) — v2.5.0 is the latest + [v2.5.0 release page](https://github.com/ahoy-cli/ahoy/releases/tag/v2.5.0) - v2.5.0 is the latest v2 release, and there is no `ahoy@2` Homebrew formula. ```bash