4 Commits

Author	SHA1	Message	Date
nevaforget	ac2b210a1f	fix: audit remediation — security, quality and performance fixes ... - CI Dockerfile: verify act_runner SHA256, restrict sudoers to safe pacman arguments (S-C1, S-C2) - cliphist: split into cliphist-text + cliphist-image services with Type=simple for proper PID tracking and restart (Q-C3) - batsaver-toggle: validate sysfs input as numeric, check state file write (Q-C2, S-W2) - udev battery rule: add ACTION=="add" filter to avoid firing on every battery event (Q-W3) - cpugov: replace eval with direct expansion, switch waybar module to signal-based updates, send SIGRTMIN+10 after toggle (Q-W1, S-W1, P-W4) - Remove docker group auto-assignment from install scripts (S-I1)	2026-04-08 11:45:56 +02:00
nevaforget	29550b8a14	fix: audit remediation — 6 fixes across quality, performance, security ... Q-01: Fix broken upower regex in moonarch-btnote (lookaheads never matched) Q-02: Fix transform.sh paru repo section name ([moonarch] → [moonarch-pkgbuilds]), config path (~/.config → /etc), and partial sync (-Sy → -Syu) Q-03: Add missing stasis package to aur.txt (idle management broken on fresh install) S-01: Switch CI git clones from HTTP to HTTPS (MITM risk in Docker network) S-02: Restrict CI builder sudo to /usr/bin/pacman only P-01: Refactor moonarch-waybar-gpustat — remove while loop, use jq --arg style	2026-04-07 10:50:57 +02:00
nevaforget	93ff264824	Add custom Arch-based act_runner image ... Runner based on archlinux:base-devel with git, curl, makepkg. Runs as non-root builder user so makepkg works natively without permission workarounds. Registration data stored in /data volume.	2026-04-01 18:09:09 +02:00
nevaforget	d4eec1c506	Add custom Arch-based act_runner image, revert workflow workaround ... The runner image is now built on archlinux:base-devel with git, curl, makepkg and a non-root builder user baked in. This removes the need for per-workflow pacman installs and enables host mode.	2026-04-01 18:09:09 +02:00