nevaforget 8aaf7cae5b fix: audit MEDIUM fixes — merge fallback, service hardening, CI token
- moonarch-waybar: on merge failure, remove the stale output so waybar
  falls back to the system config (previously it kept running with stale
  merged data despite the error notification claiming otherwise).
- moonarch-doctor: hoist INSTALLED assignment above both OFFICIAL and AUR
  blocks so the script survives set -u when only aur.txt is present.
- zshrc parse_git_branch: gate on git rev-parse and replace three grep
  subshells with bash pattern matching, cutting prompt latency from
  ~5 subprocesses per render to 2 (status + symbolic-ref).
- moonarch-batsaver.service: validate the threshold is an integer 1-100
  before writing to sysfs, add NoNewPrivileges and protection directives
  instead of relying on kernel validation alone.
- ci/act-runner/Dockerfile: drop the broad "pacman -Sy *" sudoers entry
  (only -S --needed is required by makepkg), and pin run.sh to
  act_runner:0.3.1 so it cannot drift ahead of the pinned binary.
- .gitea/workflows/update-pkgver.yaml: push via credential.helper=store
  with a chmod 600 temp file instead of `git -c http.extraHeader=...`,
  so the token no longer shows up in /proc/PID/cmdline.
2026-04-24 13:15:52 +02:00

154 lines
5.1 KiB
Bash

# ABOUTME: Moonarch default zsh configuration with Catppuccin-themed prompt.
# ABOUTME: Sources user overrides from ~/.zshrc.d/ and ~/.zshrc.local
# --- History ---
HISTFILE=~/.histfile
HISTSIZE=1000
SAVEHIST=1000
setopt autocd nomatch notify appendhistory sharehistory hist_ignore_space hist_ignore_all_dups hist_save_no_dups hist_find_no_dups
unsetopt beep extendedglob
bindkey -e
# --- Completion ---
zstyle :compinstall filename "$HOME/.zshrc"
autoload -Uz compinit
compinit
# --- Window title ---
autoload -Uz add-zsh-hook
_precmd_title() {
print -Pn "\e]0;%~\a"
}
_preexec_title() {
print -Pn "\e]0;$2\a"
}
add-zsh-hook precmd _precmd_title
add-zsh-hook preexec _preexec_title
# --- Prompt (Catppuccin Mocha) ---
parse_git_branch() {
# Gate on cheap check first — spawning git in every non-repo directory on every
# prompt render costs 20-80ms per prompt. Pattern-match the status output with
# zsh glob matching instead of piping to grep for three subshell-spawning checks.
git rev-parse --git-dir &>/dev/null || return
local branch="" git_status="" color=green flags=""
branch=$(git symbolic-ref --short HEAD 2>/dev/null || git rev-parse --short HEAD 2>/dev/null)
git_status=$(git status --porcelain 2>/dev/null)
if [[ "$git_status" == *$'\n M '* || "$git_status" == " M "* || "$git_status" == *$'\nM'* ]]; then
color=yellow; flags+="*"
fi
if [[ "$git_status" == *$'\nA '* || "$git_status" == "A "* || "$git_status" == *'??'* ]]; then
color=yellow; flags+="+"
fi
if [[ "$git_status" == *$'\n D '* || "$git_status" == " D "* ]]; then
color=yellow; flags+="-"
fi
if [[ -n "$branch" ]]; then
echo " [%F{${color}}${branch}${flags}%F{reset}]"
fi
}
precmd() {
print ""
print -rP "%F{#b4befe}%B%n@%M%b %2~%F{#f5e0dc}$(parse_git_branch)%f"
}
PROMPT="%B%F{#b4befe}$%f%b "
RPROMPT="%F{241}%B%T%b%f"
# --- PATH ---
if [ -d "$HOME/.local/bin" ]; then
PATH="$HOME/.local/bin:$PATH"
fi
# --- Key bindings ---
bindkey "^[[3~" delete-char
bindkey "^[[H" beginning-of-line
bindkey "^[[F" end-of-line
bindkey "^[[1;5C" forward-word
bindkey "^[[1;5D" backward-word
# --- Aliases ---
alias ssh="TERM=xterm-256color ssh"
alias orphans='[[ -n $(pacman -Qdt) ]] && sudo pacman -Rs $(pacman -Qdtq) || echo "no orphans to remove"'
alias ls='eza --icons --color=always --group-directories-first'
alias ll='eza -lF --icons --color=always --group-directories-first'
alias la='eza -a --icons --color=always --group-directories-first'
alias l='eza -F --icons --color=always --group-directories-first'
alias vim='nvim'
alias uninstall='sudo pacman -Rsn'
# --- Extract archives ---
function extract() {
if [ -f "$1" ]; then
case "$1" in
*.tar.bz2) tar xjvf "$1" ;;
*.tar.gz) tar xzvf "$1" ;;
*.tar.xz) tar xvf "$1" ;;
*.bz2) bzip2 -d "$1" ;;
*.rar) unrar2dir "$1" ;;
*.gz) gunzip "$1" ;;
*.tar) tar xf "$1" ;;
*.tbz2) tar xjf "$1" ;;
*.tgz) tar xzf "$1" ;;
*.zip) unzip2dir "$1" ;;
*.Z) uncompress "$1" ;;
*.7z) 7z x "$1" ;;
*.ace) unace x "$1" ;;
*) echo "'$1' cannot be extracted via extract()" ;;
esac
else
echo "'$1' is not a valid file"
fi
}
# --- FZF ---
if command -v fzf &>/dev/null; then
eval "$(fzf --zsh)"
export FZF_DEFAULT_COMMAND="fd --hidden --strip-cwd-prefix --exclude .git"
export FZF_CTRL_T_COMMAND="$FZF_DEFAULT_COMMAND"
export FZF_ALT_C_COMMAND="fd --type=d --hidden --strip-cwd-prefix --exclude .git"
export FZF_DEFAULT_OPTS="--height 50% --layout=default --border --color=hl:#2dd4bf"
export FZF_CTRL_T_OPTS="--preview 'bat --color=always -n --line-range :500 {}'"
export FZF_ALT_C_OPTS="--preview 'eza --tree --color=always {} | head -200'"
fi
# --- Plugins (system packages) ---
if [[ -f /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh ]]; then
source /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
fi
if [[ -f /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh ]]; then
source /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh
ZSH_AUTOSUGGEST_STRATEGY=(history completion)
fi
# --- Wayland environment ---
export TERMINAL="footclient"
export GDK_BACKEND="wayland,x11,*"
export QT_QPA_PLATFORM="wayland;xcb"
export QT_QPA_PLATFORMTHEME="qt6ct"
export QT_AUTO_SCREEN_SCALE_FACTOR="1"
export QT_WAYLAND_DISABLE_WINDOWDECORATION="1"
export SDL_VIDEODRIVER="wayland"
export CLUTTER_BACKEND="wayland"
export XDG_CURRENT_DESKTOP="niri"
export XDG_SESSION_DESKTOP="niri"
export XDG_SESSION_TYPE="wayland"
export EDITOR="nvim"
export SUDO_EDITOR="nvim"
export MOZ_ENABLE_WAYLAND="1"
# --- User override scripts ---
# Drop custom config snippets into ~/.zshrc.d/*.zsh
if [[ -d "$HOME/.zshrc.d" ]]; then
for f in "$HOME/.zshrc.d"/*.zsh(N); do
source "$f"
done
fi
# Single-file user override (for simple additions)
[[ -f "$HOME/.zshrc.local" ]] && source "$HOME/.zshrc.local"