[jsdiazp]

Summary

Adds a CI pipeline whose single required check, CI gate, passes only when every safety check passes. Stacked on #1 (the tests exercise its scripts); GitHub retargets this PR to main when #1 merges.

Pipeline (.github/workflows/ci.yml, replaces lint.yml)

• lint: shellcheck 0.11.0 + shfmt 3.14.1 over setup, scripts, CI scripts and tests.
• actionlint: lints the workflows (and their run: blocks with the pinned shellcheck).
• secrets: gitleaks over the full history, --redact so nothing leaks into the public log.
• tests: the new suite on Ubuntu (bash 5) and macOS (real /bin/bash 3.2.57).
• gate: if: always(), fails unless all of the above succeeded, so a skipped or cancelled job can't slip through.
• pull_request only (never pull_request_target), read-only token, no secrets, no path filters. actions/checkout pinned to a commit SHA; every other tool is a release binary verified against GitHub's published SHA-256 digest by .github/scripts/install-tool.sh. Dependabot keeps the SHA pin current.

Tests (tests/, 81 tests, no dependencies, about 30 s)
Each test runs in a scrubbed env -i process with a scratch HOME, stub binaries first on PATH, and pinned ASCII output, so nothing ambient can change a result and no real package manager runs. They pin the behaviors that were real bugs or destructive-action guards in #1: tasks run under bash, nested run_step, spinner never outliving its shell, --yes can't answer the Homebrew-uninstall prompt, ubuntu.sh runs nothing unless confirmed, .zshrc/.zprofile are never deleted, one summary row per updater, failing tasks exit non-zero, tmux/alacritty configs parse.

Found while writing the tests: sed_inplace aborted (BSD sed) or silently replaced the link (GNU sed) when ~/.zshrc is a symlink into a dotfiles repo, so setup_zsh broke for that common setup. Fixed in common.sh with a regression test.

How I checked the tests are real

For each guard I reverted it in a scratch copy and confirmed a test fails (zsh interpreter, strict confirm, ubuntu consent gate, .zprofile deletion, spinner parent check, summary double-recording, temp-file leaks, tmux/alacritty edits, and more). Only one mutant survived: removing a local that affects nothing but a step's elapsed time, which the suite deliberately doesn't assert.

After merging

main is unprotected today. Once #1 and this PR are merged and CI gate has run on main, a ruleset requiring a PR and the CI gate check (admin bypass allowed, 0 approvals, no force-push or deletion) will be created. It can't be created earlier without blocking #1 on a check that doesn't exist there yet.

Known gaps

• Windows .ps1 scripts and vim/.vimrc (downloads plugins when run) are not executed by CI.
• tmux 3.8 silently discards a config with a parse error; the config test therefore pins key options (prefix, mouse, vi keys) instead of relying on error output.
• A step function that calls bare exit (not die) leaves one empty capture file in $TMPDIR; harmless litter, documented by a test.
• The first Ubuntu run exposed a real hermeticity gap (the runner image ships composer, which an unstubbed test then ran for real). Tests now get a PATH of stubs plus a filtered farm of system tools with package managers, git/curl and sudo removed, so an unstubbed tool is "command not found" on any image. Both legs are green.

🤖 Generated with Claude Code