Vendor chezmoi install script

Author: linuxdaemon

.github/renovate.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:base"],
+  "platform": "github",
+  "labels": ["update"],
+  "prConcurrentLimit": 5,
+  "packageRules": [
+    {
+      "matchManagers": ["github-actions"],
+      "pinDigests": true,
+      "commitMessageTopic": "github-actions",
+      "groupName": "github-actions",
+      "automerge": false
+    }
+  ]
+}

.github/workflows/update-install-script.yaml

@@ -0,0 +1,43 @@
+name: Update chezmoi-install.sh
+
+on:
+  schedule:
+    - cron: '0 3 * * 1' # Every Monday at 03:00 UTC
+  workflow_dispatch:
+
+jobs:
+  update-install-script:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Git user
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Run build-install.sh
+        run: ci/build-install.sh
+
+      - name: Check for changes
+        id: changes
+        run: |
+          git add scripts/chezmoi-install.sh
+          if git diff --cached --quiet; then
+            echo "changed=false" >> $GITHUB_OUTPUT
+          else
+            echo "changed=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Create Pull Request
+        if: steps.changes.outputs.changed == 'true'
+        uses: peter-evans/create-pull-request@v6
+        with:
+          commit-message: "Update chezmoi-install.sh"
+          title: "Update chezmoi-install.sh"
+          body: "Automated update of chezmoi-install.sh via scheduled workflow."
+          branch: "update/chezmoi-install-sh"
+          base: ${{ github.ref_name }}
+          labels: "update"
+          reviewers: "linuxdaemon"

README.md

@@ -1,6 +1,9 @@
 # dotfiles
 ## Install
 
+The Chezmoi install script is vendored in `scripts/chezmoi-install.sh` to reduce
+the risk of upstream changes breaking the deploy. This script is wrapped by `install.sh` with pre-set parameters.
+
 ```shell
-sh -c "$(curl -fsLS get.chezmoi.io)" -- init --apply linuxdaemon
+sh -c "$(curl -fsLS https://github.com/linuxdaemon/dotfiles/raw/refs/heads/master/install.sh)"
 ```

ci/build-install.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Vendor the install script to ensure upstream changes don't break anything
+curl -fsLS -o scripts/chezmoi-install.sh https://get.chezmoi.io
+chmod +x scripts/chezmoi-install.sh

install.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+./scripts/chezmoi-install.sh init --apply linuxdaemon