brush: vendor the source tree (un-ignore) to complete the local fork

The prior commit switched the recipe to `[source] path = "source"`, but .gitignore:77 still listed `local/recipes/shells/brush/source` (a leftover from when brush was a transient upstream git fetch), so the vendored tree was not tracked — a fresh clone would have no brush source and the build would fail. Drop that ignore line and commit the vendored working tree (reubeno/brush @ 897b373e, with the Redox port patches pre-applied). brush is now a durable local fork like the other path=source recipes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-26 23:34:31 +09:00
parent 0383dcbca3
commit 25fb843c40
675 changed files with 97606 additions and 1 deletions
@@ -0,0 +1,203 @@
+#
+# Based on https://github.com/release-plz/release-plz/blob/a5043c478d46d051c00e4fbc85036ac22510f07e/.github/workflows/cd.yml
+#
+
+name: CD # Continuous Deployment
+run-name: CD${{ github.event_name == 'release' && ' (release)' || ' (dry run)' }}
+
+on:
+  release:
+    types: [published]
+
+  # Manual triggers don't actually publish but dry-run the builds.
+  workflow_dispatch: null
+
+  # Run on PR in dry-run mode to make sure this workflow is still generally
+  # working.
+  pull_request:
+    branches: ["main"]
+
+  # Run on pushes into `main` as a way to have "nightly"-ish binaries.
+  push:
+    branches: ["main"]
+
+# Only allow one run of the workflow per branch / PR at a time.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_INCREMENTAL: 0
+  CARGO_NET_GIT_FETCH_WITH_CLI: true
+  CARGO_NET_RETRY: 10
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: 1
+  RUSTFLAGS: -D warnings
+  RUSTUP_MAX_RETRIES: 10
+
+defaults:
+  run:
+    shell: bash
+
+permissions: {}
+
+jobs:
+  upload-docs:
+    name: "Generate and upload documentation"
+
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+
+    if: github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request' || github.event_name == 'push' || (github.event_name == 'release' && github.repository_owner == 'reubeno' && startsWith(github.event.release.tag_name, 'brush-shell-v'))
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: "Install Rust toolchain"
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        with:
+          toolchain: stable
+
+      - name: "Enable cargo cache"
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+
+      - name: "Generate documentation distribution"
+        run: cargo xtask gen docs dist --out brush-docs.tar.gz
+
+      - name: "Upload documentation to release"
+        if: github.event_name == 'release'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          gh release upload ${GITHUB_RELEASE_TAG} \
+            brush-docs.tar.gz \
+            brush-docs.tar.gz.sha256 \
+            brush-docs.tar.gz.sha512
+
+      - name: "Generate artifact attestation"
+        if: github.event_name == 'release'
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        with:
+          subject-path: "brush-docs.tar.gz*"
+
+      - name: "Upload documentation artifact (dry-run)"
+        if: github.event_name != 'release'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: brush-docs
+          path: |
+            brush-docs.tar.gz
+            brush-docs.tar.gz.sha256
+            brush-docs.tar.gz.sha512
+
+  upload-assets:
+    name: ${{ matrix.target }}
+
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+
+    if: github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request' || github.event_name == 'push' || (github.event_name == 'release' && github.repository_owner == 'reubeno' && startsWith(github.event.release.tag_name, 'brush-shell-v'))
+    runs-on: ${{ matrix.os }}
+    strategy:
+      # Run all jobs to completion regardless of errors.
+      # This is useful because sometimes we fail to compile for a certain target.
+      fail-fast: false
+      matrix:
+        include:
+          - target: aarch64-pc-windows-msvc
+            os: windows-2025
+            force_dry_run: true
+          - target: x86_64-unknown-linux-gnu
+            os: ubuntu-22.04
+            force_dry_run: false
+          - target: x86_64-apple-darwin
+            os: macos-15-intel
+            force_dry_run: false
+          - target: x86_64-pc-windows-msvc
+            os: windows-2025
+            force_dry_run: true
+          - target: x86_64-unknown-linux-musl
+            os: ubuntu-22.04
+            force_dry_run: false
+          - target: aarch64-unknown-linux-gnu
+            os: ubuntu-22.04
+            force_dry_run: false
+          - target: aarch64-unknown-linux-musl
+            os: ubuntu-22.04
+            force_dry_run: false
+          - target: aarch64-apple-darwin
+            os: macos-14
+            force_dry_run: false
+    timeout-minutes: 60
+
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: "Install Rust toolchain"
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+
+      - name: "Setup cross-compiling toolchain"
+        if: startsWith(matrix.os, 'ubuntu') && !contains(matrix.target, '-musl')
+        uses: taiki-e/setup-cross-toolchain-action@3d9770ce98eb7dbcf378563182a5e8031165f75b # v1.41.0
+        with:
+          target: ${{ matrix.target }}
+
+      - name: "Install musl cross tools"
+        if: contains(matrix.target, '-musl')
+        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: cross
+
+      - name: "Workaround: clean cache"
+        run: cargo clean
+
+      - name: "Install cargo-about"
+        run: cargo install cargo-about --locked --features cli
+
+      - name: "Generate license notices"
+        working-directory: brush-shell
+        run: cargo about generate -o ../THIRD_PARTY_LICENSES.html about.hbs
+
+      - name: "Update build flags"
+        if: endsWith(matrix.target, 'windows-msvc')
+        run: echo "RUSTFLAGS=${RUSTFLAGS} -C target-feature=+crt-static" >> "${GITHUB_ENV}"
+
+      - name: "Build and upload binaries to release"
+        uses: taiki-e/upload-rust-binary-action@f0d45ae91ee7b8ee928de7a9d04d893a08bcbec6 # v1.30.2
+        id: upload-release
+        with:
+          dry-run: ${{ github.event_name != 'release' || matrix.force_dry_run }}
+          bin: brush
+          locked: true
+          target: ${{ matrix.target }}
+          tar: unix
+          zip: windows
+          checksum: sha256,sha512
+          token: ${{ secrets.GITHUB_TOKEN }}
+          include: "LICENSE,THIRD_PARTY_LICENSES.html"
+
+      - name: "Generate artifact attestation"
+        if: github.event_name == 'release' && !matrix.force_dry_run
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        with:
+          subject-path: "${{ steps.upload-release.outputs.archive }}.*"
+
+      - name: "Upload artifacts (dry-run)"
+        if: github.event_name != 'release' || matrix.force_dry_run
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: brush-${{ matrix.target }}
+          path: "${{ steps.upload-release.outputs.archive }}.*"
@@ -0,0 +1,138 @@
+name: "PR Reports"
+on:
+  # We intentionally run this workflow in the context of the target of a PR; we are careful
+  # an intentional about how we handle the data coming from the PR.
+  workflow_run: # zizmor: ignore[dangerous-triggers]
+    workflows: ["CI"]
+    types:
+      - completed
+
+permissions: {}
+
+jobs:
+  report:
+    name: "Report"
+
+    permissions:
+      actions: read
+      checks: write
+      contents: read
+      pull-requests: write
+
+    runs-on: ubuntu-24.04
+
+    # We only run this job if the workflow run that completed was triggered by a pull request.
+    if: github.event.workflow_run.event == 'pull_request'
+
+    steps:
+      - name: Extract PR number and create event file
+        id: get-pr
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const fs = require('fs');
+
+            // Find the workflow run that triggered this job.
+            const workflowRun = await github.rest.actions.getWorkflowRun({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: context.payload.workflow_run.id,
+            });
+
+            // Extract the source commit info.
+            const { head_branch, head_sha, head_repository } = workflowRun.data;
+            const head_repo_owner = head_repository.owner.login;
+            core.setOutput('head_branch', head_branch);
+            core.setOutput('head_sha', head_sha);
+            core.setOutput('head_repo', head_repository.full_name);
+
+            // Try to find all PRs from that source.
+            const { data: prs } = await github.rest.pulls.list({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open',
+              head: `${head_repo_owner}:${head_branch}`,
+              per_page: 20
+            });
+
+            // Filter PRs to find the one that targets the main branch.
+            // NOTE: This only supports a target branch of 'main'.
+            const filtered_prs = prs.filter(pr => pr.base.ref === 'main');
+
+            if (filtered_prs.length > 0) {
+              const pr = filtered_prs[0];
+              core.setOutput('pr_number', pr.number);
+
+              // Write out a mostly-stubbed event file.
+              const eventData = {
+                pull_request: {
+                  head: {
+                    sha: head_sha,
+                    repo: {
+                      full_name: head_repository.full_name
+                    }
+                  }
+                }
+              };
+
+              fs.writeFileSync('event-file.json', JSON.stringify(eventData), 'utf-8');
+            } else {
+              core.setOutput('pr_number', '');
+            }
+
+      - name: Download code coverage reports
+        if: steps.get-pr.outputs.pr_number != ''
+        continue-on-error: true
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: codecov-reports*
+          merge-multiple: true
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+          path: reports/
+
+      - name: Download performance reports
+        if: steps.get-pr.outputs.pr_number != ''
+        continue-on-error: true
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: perf-reports*
+          merge-multiple: true
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+          path: reports/
+
+      - name: Download test results
+        if: steps.get-pr.outputs.pr_number != ''
+        continue-on-error: true
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: test-reports*
+          merge-multiple: true
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+          path: reports/
+
+      - name: Show published reports
+        continue-on-error: true
+        if: steps.get-pr.outputs.pr_number != ''
+        run: |
+          ls -lR reports/
+
+      - name: "Publish test results"
+        uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2.24.0
+        if: steps.get-pr.outputs.pr_number != ''
+        continue-on-error: true
+        with:
+          commit: ${{ github.event.workflow_run.head_sha }}
+          event_file: event-file.json
+          event_name: ${{ github.event.workflow_run.event }}
+          files: reports/test-results-*.xml
+
+      - name: "Publish available .md reports to PR"
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
+        if: steps.get-pr.outputs.pr_number != ''
+        with:
+          path: reports/*.md
+          number: ${{ steps.get-pr.outputs.pr_number }}
@@ -0,0 +1,764 @@
+name: "CI"
+on:
+  pull_request:
+    paths-ignore:
+      - "release-plz.toml"
+  push:
+    paths-ignore:
+      - "docs/**"
+      - "**.md"
+      - "LICENSE"
+      - "release-plz.toml"
+    branches:
+      - main
+
+env:
+  RUST_BACKTRACE: 1
+  CARGO_TERM_COLOR: always
+  CLICOLOR: 1
+  CLICOLOR_FORCE: 1
+
+permissions:
+  actions: read
+  contents: read
+
+# Only allow one run of the workflow per branch / PR at a time.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Build and upload release binaries for all relevant architectures.
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Build for x86_64/linux target on native host.
+          # N.B. We intentionally pin to Ubuntu 22.04 for now to increase
+          # the range of distros that will be able to run the produced binaries.
+          # Newer release of Ubuntu upgrade glibc to a point not yet supported
+          # by some latest stable versions of distros.
+          - host: "ubuntu-22.04"
+            target: ""
+            cross_command: ""
+            cross_tool_to_install: ""
+            os: "linux"
+            arch: "x86_64"
+            binary_name: "brush"
+            extra_build_args: ""
+          # Build for x86_64/linux using musl as target C runtime.
+          # We don't bother pinning to an ealier version of Ubuntu because
+          # the produced binary will statically link the C runtime anyhow.
+          - host: "ubuntu-24.04"
+            target: "x86_64-unknown-linux-musl"
+            cross_command: "cross"
+            cross_tool_to_install: "cross"
+            os: "linux-musl"
+            arch: "x86_64"
+            binary_name: "brush"
+            extra_build_args: ""
+          # Build for aarch64/macos target on native host.
+          - host: "macos-latest"
+            target: ""
+            cross_command: ""
+            cross_tool_to_install: ""
+            os: "macos"
+            arch: "aarch64"
+            required_tools: ""
+            binary_name: "brush"
+            extra_build_args: ""
+          # Build for aarch64/linux target on x86_64/Linux host.
+          - host: "ubuntu-24.04"
+            target: "aarch64-unknown-linux-gnu"
+            cross_command: "cross"
+            cross_tool_to_install: "cross"
+            os: "linux"
+            arch: "aarch64"
+            required_tools: "gcc-aarch64-linux-gnu"
+            binary_name: "brush"
+            extra_build_args: ""
+          # Build for wasm32 target on x86_64/linux host.
+          - host: "ubuntu-24.04"
+            target: "wasm32-unknown-unknown"
+            cross_command: "cross"
+            cross_tool_to_install: "cross"
+            os: "unknown"
+            arch: "wasm32"
+            required_tools: ""
+            binary_name: "brush.wasm"
+            extra_build_args: "--no-default-features --features minimal"
+          # Build for WASI-0.2 target on x86_64/linux host.
+          - host: "ubuntu-24.04"
+            target: "wasm32-wasip2"
+            cross_command: "cross"
+            cross_tool_to_install: "cross"
+            os: "wasi-0.2"
+            arch: "wasm32"
+            required_tools: ""
+            binary_name: "brush.wasm"
+            extra_build_args: "--no-default-features --features minimal"
+          # Build for x86_64/windows target on x86_64/linux host.
+          - host: "ubuntu-24.04"
+            target: "x86_64-pc-windows-gnu"
+            cross_command: "cross"
+            cross_tool_to_install: "cross"
+            os: "windows"
+            arch: "x86_64"
+            required_tools: ""
+            binary_name: "brush.exe"
+            extra_build_args: ""
+          # Build for x86_64/android target on x86_64/linux host.
+          - host: "ubuntu-24.04"
+            target: "x86_64-linux-android"
+            cross_command: "cargo ndk"
+            cross_tool_to_install: "cargo-ndk"
+            os: "android"
+            arch: "x86_64"
+            required_tools: ""
+            binary_name: "brush"
+            extra_build_args: ""
+          # x86_64/FreeBSD target on x86_64/linux host, via cross. Compile-check
+          # only (check_only): cross's curated sysroot omits some base-system
+          # libraries (libgeom/libkvm/...) that `sysinfo` links against, so the
+          # final link of a real binary fails. Checking still validates that the
+          # shell compiles for the target; producing a binary is a TODO (would
+          # need a full sysroot with those libraries present).
+          - host: "ubuntu-24.04"
+            target: "x86_64-unknown-freebsd"
+            cross_command: "cross"
+            cross_tool_to_install: "cross"
+            os: "freebsd"
+            arch: "x86_64"
+            required_tools: ""
+            binary_name: "brush"
+            extra_build_args: ""
+            check_only: true
+          # x86_64/NetBSD target on x86_64/linux host, via cross. Compile-check
+          # only for the same reason as FreeBSD above.
+          - host: "ubuntu-24.04"
+            target: "x86_64-unknown-netbsd"
+            cross_command: "cross"
+            cross_tool_to_install: "cross"
+            os: "netbsd"
+            arch: "x86_64"
+            required_tools: ""
+            binary_name: "brush"
+            extra_build_args: ""
+            check_only: true
+          # OpenBSD is tier-3 with no prebuilt std, so even compile-checking it
+          # requires building std from source (-Zbuild-std, hence nightly +
+          # rust-src + no rustup target). panic_abort is built explicitly because
+          # our release profile sets panic = "abort" (plain -Zbuild-std only
+          # builds std + panic_unwind). Compile-check only, like the other BSDs;
+          # check links nothing, so no C cross-compiler/sysroot/linker is needed
+          # (none of the workspace's C-compiling deps are in this default graph).
+          - host: "ubuntu-24.04"
+            target: "x86_64-unknown-openbsd"
+            cross_command: "cargo"
+            cross_tool_to_install: ""
+            os: "openbsd"
+            arch: "x86_64"
+            required_tools: ""
+            binary_name: "brush"
+            extra_build_args: "-Zbuild-std=std,panic_abort"
+            toolchain: "nightly"
+            components: "rust-src"
+            # std is built from source, so there's no prebuilt target to install.
+            skip_rustup_target: true
+            check_only: true
+
+    name: "${{ matrix.check_only && 'Check' || 'Build' }} (${{ matrix.arch }}/${{ matrix.os }})"
+    runs-on: ${{ matrix.host }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Set up rust toolchain
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        with:
+          toolchain: ${{ matrix.toolchain || 'stable' }}
+          targets: ${{ !matrix.skip_rustup_target && matrix.target || '' }}
+          components: ${{ matrix.components || '' }}
+
+      - name: Enable cargo cache
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          key: "${{ matrix.target }}"
+
+      - name: Install additional prerequisite tools
+        if: ${{ matrix.required_tools != '' }}
+        env:
+          REQUIRED_TOOLS: ${{ matrix.required_tools }}
+        run: sudo apt-get update -y && sudo apt-get install -y ${REQUIRED_TOOLS}
+
+      - name: Install cross-compilation toolchain
+        if: ${{ matrix.cross_tool_to_install != '' }}
+        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: ${{ matrix.cross_tool_to_install }}
+
+      - name: "Build (native)"
+        if: ${{ matrix.target == '' }}
+        env:
+          EXTRA_BUILD_ARGS: ${{ matrix.extra_build_args }}
+        run: cargo build --release --all-targets ${EXTRA_BUILD_ARGS}
+
+      - name: "${{ matrix.check_only && 'Check' || 'Build' }} (cross)"
+        if: ${{ matrix.target != '' }}
+        env:
+          CROSS_COMMAND: ${{ matrix.cross_command }}
+          CARGO_SUBCOMMAND: ${{ matrix.check_only && 'check' || 'build' }}
+          TARGET: ${{ matrix.target }}
+          EXTRA_BUILD_ARGS: ${{ matrix.extra_build_args }}
+          CARGO_NDK_PLATFORM: 24
+        run: ${CROSS_COMMAND} ${CARGO_SUBCOMMAND} --release --target=${TARGET} ${EXTRA_BUILD_ARGS}
+
+      - name: "Upload binaries"
+        # check_only targets don't produce a binary to upload.
+        if: ${{ !matrix.check_only }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: binaries-${{ matrix.arch }}-${{ matrix.os }}
+          path: target/${{ matrix.target }}/release/${{ matrix.binary_name }}
+
+      - name: "Upload integration test binaries"
+        if: ${{ matrix.target == '' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: integration-tests-${{ matrix.arch }}-${{ matrix.os }}
+          path: |
+            target/${{ matrix.target }}/release/deps/brush_*_tests-*
+            !**/*.d
+
+  # Test functional correctness
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - host: "ubuntu-24.04"
+            variant: "linux-x86_64"
+            artifact_suffix: "linux-x86_64"
+            name_suffix: "(linux/x86_64)"
+            homebrew_supported: true
+            coverage: true
+            coverage_min_percent: 70
+
+          - host: "ubuntu-24.04-arm"
+            variant: "linux-aarch64"
+            artifact_suffix: "linux-aarch64"
+            name_suffix: "(linux/aarch64)"
+            homebrew_supported: false
+            coverage: true
+            coverage_min_percent: 70
+
+          - host: "macos-latest"
+            variant: "macos"
+            artifact_suffix: "-macos"
+            name_suffix: "(macOS)"
+            homebrew_supported: true
+            coverage: true
+            coverage_min_percent: 70
+
+          - host: "windows-2025"
+            variant: "windows"
+            artifact_suffix: "-windows"
+            name_suffix: "(windows)"
+            homebrew_supported: false
+            coverage: true
+            coverage_min_percent: 20
+
+          - host: "ubuntu-24.04"
+            variant: "wasi"
+            artifact_suffix: "-wasi"
+            name_suffix: "(wasm32/wasi-0.2)"
+            homebrew_supported: false
+            coverage: false
+            extra_rust_targets: "wasm32-wasip2"
+            wasi_runtime: "wasmtime"
+            xtask_test_args: "--wasi"
+
+    name: "Test ${{ matrix.name_suffix }}"
+    runs-on: ${{ matrix.host }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Set up rust toolchain
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        with:
+          toolchain: stable
+          targets: ${{ matrix.extra_rust_targets || '' }}
+          components: llvm-tools-preview
+
+      - name: Enable cargo cache
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          # Needed to make sure cargo-deny is correctly cached.
+          cache-all-crates: true
+
+      - name: Install cargo-nextest
+        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: cargo-nextest
+
+      - name: Install cargo-llvm-cov
+        if: ${{ matrix.coverage }}
+        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: cargo-llvm-cov
+
+      - name: Install WASI runtime
+        if: ${{ matrix.wasi_runtime }}
+        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: ${{ matrix.wasi_runtime }}
+
+      - name: Set up Homebrew
+        if: ${{ matrix.homebrew_supported }}
+        id: set-up-homebrew
+        # We ignore the stale-action-refs check because this action does not have any releases or tags.
+        # We're forced to pick a specific commit.
+        uses: Homebrew/actions/setup-homebrew@df4b09108a1de9d6f995fe68f302b3f68bd6d2ef # zizmor: ignore[stale-action-refs]
+        with:
+          stable: true
+
+      - name: "Install recent bash for tests"
+        if: ${{ matrix.homebrew_supported }}
+        run: |
+          set -x
+
+          # Install it
+          brew install bash
+
+          # Find the path
+          BASH_PATH="$(brew --prefix bash)/bin/bash"
+
+          # Log what we're using
+          echo "Using bash from: ${BASH_PATH}"
+          echo "bash version:"
+          ${BASH_PATH} --version
+          echo "BASH_PATH=${BASH_PATH}">>$GITHUB_ENV
+
+      - name: "Download recent bash-completion sources for tests"
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          repository: "scop/bash-completion"
+          ref: "2.17.0"
+          path: "bash-completion"
+
+      - name: "Setup bash-completion"
+        run: echo "BASH_COMPLETION_PATH=${GITHUB_WORKSPACE}/bash-completion/bash_completion">>$GITHUB_ENV
+
+      - name: Test
+        env:
+          VARIANT: ${{ matrix.variant }}
+        run: |
+          args="${{ matrix.xtask_test_args || '' }}"
+          args="${args} --results-output ./test-results-${VARIANT}.xml"
+          if [[ "${{ matrix.coverage }}" == "true" ]]; then
+            args="${args} --coverage --coverage-output ./codecov-${VARIANT}.xml"
+          fi
+          cargo xtask test integration ${args}
+
+      - name: "Upload test results"
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: always()
+        with:
+          name: test-reports${{ matrix.artifact_suffix }}
+          path: test-results-*.xml
+
+      - name: "Generate code coverage report"
+        uses: clearlyip/code-coverage-report-action@110af9d4ec87b6706f182fd90e3102af9e5203bf # v7.0.0
+        if: ${{ always() && matrix.coverage }}
+        id: "code_coverage_report"
+        with:
+          artifact_download_workflow_names: "CI"
+          artifact_name: coverage-%name%${{ matrix.artifact_suffix }}
+          filename: codecov-${{ matrix.variant }}.xml
+          overall_coverage_fail_threshold: ${{ matrix.coverage_min_percent }}
+          only_list_changed_files: ${{ github.event_name == 'pull_request' }}
+          fail_on_negative_difference: true
+          negative_difference_by: "overall"
+          negative_difference_threshold: 5
+
+      - name: "Upload code coverage report"
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: always()
+        with:
+          name: codecov-reports${{ matrix.artifact_suffix }}
+          path: code-coverage-results.md
+
+  # Static analysis of the code.
+  check:
+    name: "Source code checks"
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      matrix:
+        # Test latest stable as well as MSRV.
+        rust-version: ["stable", "1.88.0"]
+        # Run checks on Linux, Windows, and macOS.
+        os: ["ubuntu-24.04", "windows-2025", "macos-latest"]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Set up rust toolchain (${{ matrix.rust-version }})
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        with:
+          toolchain: ${{ matrix.rust-version }}
+          components: clippy, rustfmt
+
+      - name: Enable cargo cache
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          # Needed to make sure cargo-deny is correctly cached.
+          cache-all-crates: true
+
+      - name: Format check
+        run: cargo xtask check fmt
+
+      - name: Check
+        run: cargo xtask check build
+
+      - name: Install cargo-deny
+        if: runner.os == 'Linux'
+        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: cargo-deny
+
+      # NOTE: Only run on Linux. cargo-deny checks (advisories, licenses, bans,
+      # sources) are platform-independent, so running on one OS is sufficient.
+      # Also works around a cargo-deny 0.19.x bug where its advisory DB parser
+      # panics on Windows due to CRLF line endings (hardcoded LF-only matching).
+      - name: Deny check
+        if: runner.os == 'Linux'
+        run: cargo xtask check deps
+
+      - name: Clippy check
+        if: matrix.rust-version == 'stable'
+        run: cargo xtask check lint
+
+  # Check for unneeded dependencies.
+  check-deps:
+    name: "Check for unneeded dependencies"
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Set up nightly rust toolchain
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        with:
+          toolchain: nightly
+
+      - name: Install cargo-udeps
+        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: cargo-udeps
+
+      - name: Check for unused dependencies
+        run: cargo xtask check unused-deps
+
+  # Check that generated schemas are up-to-date
+  check-schemas:
+    name: "Check generated schemas"
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Set up rust toolchain
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        with:
+          toolchain: stable
+
+      - name: Enable cargo cache
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+
+      - name: Check generated schemas
+        run: cargo xtask check schemas
+
+  # Analyze public API surface
+  analyze-public-api:
+    if: github.event_name == 'pull_request'
+    name: "Analyze public API"
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Set up nightly rust toolchain
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        with:
+          toolchain: nightly
+
+      - name: Install cargo-public-api
+        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: cargo-public-api
+
+      - name: Set up branches
+        run: |
+          set -euo pipefail
+          git fetch origin main
+
+      - name: Compare public APIs with main
+        run: cargo xtask analyze public-api --base origin/main --output-dir reports
+
+      - name: Upload test report
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: test-reports-public-api
+          path: reports/*.md
+
+  # Performance analysis of the code.
+  benchmark:
+    if: github.event_name == 'pull_request'
+    name: "Benchmarks"
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout PR sources
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          path: pr
+
+      - name: Checkout main sources
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          path: main
+          ref: main
+
+      - name: Set up rust toolchain
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        with:
+          toolchain: stable
+
+      - name: Enable cargo cache
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          workspaces: |
+            ./pr
+            ./main
+
+      - name: Performance analysis on PR
+        run: cargo xtask analyze bench --output benchmarks.txt
+        working-directory: pr
+
+      - name: Performance analysis on main
+        run: cargo bench --workspace --benches -- --output-format bencher | tee benchmarks.txt
+        working-directory: main
+
+      - name: Compare benchmark results
+        run: |
+          ./pr/scripts/compare-benchmark-results.py -b main/benchmarks.txt -t pr/benchmarks.txt >benchmark-results.md
+
+      - name: Upload performance results
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: perf-reports
+          path: |
+            pr/benchmarks.txt
+            main/benchmarks.txt
+            benchmark-results.md
+
+  # Run bash-completion test suite
+  bash-completion-tests:
+    name: "External tests / bash-completion test suite"
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Checkout brush
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          path: "brush"
+
+      - name: Checkout bash-completion
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          repository: "scop/bash-completion"
+          ref: "2.16.0"
+          path: "bash-completion"
+
+      - name: Download prebuilt brush binaries
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: "binaries-x86_64-linux"
+          path: "binaries"
+
+      - name: Setup downloads
+        run: |
+          chmod +x binaries/*
+          ls -l binaries
+
+      - name: Install prerequisites for running tests
+        run: |
+          set -x
+          sudo apt-get update -y
+          sudo apt-get install -y python3
+          python3 -m pip install --user pytest pytest-xdist pytest-md-report pytest-json-report
+
+      - name: "Run test suite (brush)"
+        working-directory: brush
+        run: |
+          cargo xtask test \
+              --brush-path $GITHUB_WORKSPACE/binaries/brush \
+              external bash-completion \
+              --bash-completion-path $GITHUB_WORKSPACE/bash-completion \
+              --output $GITHUB_WORKSPACE/test-results-bash-completion.json \
+              --summary-output $GITHUB_WORKSPACE/test-results-bash-completion.md || true
+
+      - name: Upload test report
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: test-reports-bash-completion
+          path: |
+            test-results-bash-completion.md
+
+  # Test release binary on a variety of OS platforms.
+  os-tests:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # N.B. We don't include Ubuntu because it's already covered by the initial test job.
+          - container: "archlinux:latest"
+            description: "Arch Linux/latest"
+            prereqs_command: "pacman -Sy --noconfirm bash-completion iputils grep less sed util-linux which"
+
+          - container: "mcr.microsoft.com/azurelinux-beta/base/core:4.0"
+            description: "Azure Linux/4.0"
+            prereqs_command: "dnf install -y bash-completion ca-certificates git iputils grep less sed util-linux which"
+
+          - container: "debian:testing"
+            description: "Debian/testing"
+            prereqs_command: "apt-get update -y && apt-get install -y bash-completion bsdmainutils iputils-ping grep less sed which"
+
+          - container: "fedora:latest"
+            description: "Fedora/latest"
+            prereqs_command: "dnf install -y bash-completion iputils grep less sed util-linux which"
+
+          - container: "nixos/nix:latest"
+            description: "NixOS/latest"
+            prereqs_command: "nix --extra-experimental-features nix-command --extra-experimental-features flakes profile install nixpkgs#gnused nixpkgs#hexdump nixpkgs#bash-completion"
+
+          # NOTE: We use Tumbleweed to make sure we get a recent enough version of bash.
+          - container: "opensuse/tumbleweed:latest"
+            description: "openSUSE Tumbleweed/latest"
+            prereqs_command: "zypper install -y bash-completion git which"
+
+    name: "OS target tests (${{ matrix.description }})"
+    runs-on: ubuntu-24.04
+    container: ${{ matrix.container }}
+    needs: build
+    env:
+      # Reference: https://github.com/Azure/azure-cli/issues/29835
+      GNUPGHOME: /root/.gnupg
+    steps:
+      # Install prerequisites *first*; may need some of them for checkout itself.
+      - name: Install prerequisites
+        if: ${{ matrix.prereqs_command != '' }}
+        env:
+          PREREQS_COMMAND: ${{ matrix.prereqs_command }}
+        run: bash -c "${PREREQS_COMMAND}"
+
+      # Workaround path issues on NixOS
+      - name: "Apply workarounds: NixOS"
+        if: ${{ matrix.container == 'nixos/nix:latest' }}
+        run: |
+          set -x
+
+          # Allow use of experimental features to avoid nix from complaining.
+          export NIX_CONFIG="extra-experimental-features = nix-command flakes"
+
+          # The nixos/nix image ships no /etc/os-release (unlike a full NixOS install
+          # and every other container we test against). Provide one so the test harness
+          # can identify the OS, which it relies on for tests' `incompatible_os` tags.
+          printf 'NAME=NixOS\nID=nixos\nPRETTY_NAME="NixOS (nix container)"\n' > /etc/os-release
+
+          # Hacks to get the mounted nodejs by github actions work as it's dynamically linked
+          # https://github.com/actions/checkout/issues/334#issuecomment-716068696
+          nix build --no-link --max-jobs 2 --cores 0 'nixpkgs#stdenv.cc.cc.lib' 'nixpkgs#glibc'
+          echo "LD_LIBRARY_PATH=$(nix path-info 'nixpkgs#stdenv.cc.cc.lib')/lib" >> "$GITHUB_ENV"
+          ln -s "$(nix path-info 'nixpkgs#glibc' --recursive | grep glibc | grep -v bin)/lib64" /lib64
+
+          # Provide alternate path for bash-completion
+          echo "BASH_COMPLETION_PATH=$(nix path-info 'nixpkgs#bash-completion')/share/bash-completion/bash_completion">>"$GITHUB_ENV"
+
+          # Forcibly add system paths
+          echo "BRUSH_TEST_PATH_VAR=$PATH">>"$GITHUB_ENV"
+
+      # Checkout sources for YAML-based test cases
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          path: sources
+
+      - name: Download prebuilt brush binaries
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: binaries-x86_64-linux
+          path: binaries
+
+      - name: Download integration test binaries
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: integration-tests-x86_64-linux
+          path: binaries
+
+      - name: Setup downloads
+        run: |
+          # N.B. Can't use -o pipefail because it's not supported on Debian.
+          set -eux
+          chmod +x binaries/*
+          ls -l -R sources/brush-shell/tests
+          ls -l binaries
+
+      - name: Run tests
+        shell: bash
+        run: |
+          export BRUSH_PATH=$PWD/binaries/brush
+          export BRUSH_VERBOSE=true
+
+          result=0
+          for test_name in binaries/*tests*; do
+            if [[ ${test_name} == *compat* ]]; then
+              export BRUSH_TEST_CASES=$PWD/sources/brush-shell/tests/cases/compat
+            elif [[ ${test_name} == *integration* ]]; then
+              export BRUSH_TEST_CASES=$PWD/sources/brush-shell/tests/cases/brush
+            elif [[ ${test_name} == *interactive* || ${test_name} == *version* ]]; then
+              # TODO(tests): Re-enable these tests.
+              echo "WARNING: skipping test: ${test_name}"
+              continue
+            fi
+
+            echo "Running test: ${test_name}"
+            chmod +x ${test_name}
+            ${test_name} || result=$?
+          done
+
+          exit ${result}
@@ -0,0 +1,69 @@
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+  schedule:
+    - cron: "35 1 * * 3"
+
+permissions: {}
+
+# Only allow one run of the workflow per branch / PR at a time.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      # required for all workflows
+      security-events: write
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+          - language: python
+            build-mode: none
+          - language: rust
+            build-mode: none
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          queries: security-extended,security-and-quality
+
+      # - name: Set up rust toolchain
+      #   if: ${{ matrix.language == 'rust' }}
+      #   uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # v1
+      #   with:
+      #     toolchain: stable
+
+      # - name: Enable cargo cache
+      #   if: ${{ matrix.language == 'rust' }}
+      #   uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+
+      # - name: Build Rust code
+      #   if: ${{ matrix.language == 'rust' }}
+      #   run: cargo build --all-targets --all-features
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        with:
+          category: "/language:${{matrix.language}}"
@@ -0,0 +1,72 @@
+name: "Devcontainer"
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    paths:
+      - ".devcontainer/**"
+
+permissions: {}
+
+# Only allow one run of the workflow per branch / PR at a time.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: "Build devcontainer"
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Pre-build dev container image
+        uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca # v0.3.1900000450
+        with:
+          imageName: ghcr.io/reubeno/brush/devcontainer
+          imageTag: latest
+          cacheFrom: ghcr.io/reubeno/brush/devcontainer
+          push: never
+
+  build_and_publish:
+    name: "Build and publish devcontainer"
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Pre-build dev container image
+        uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca # v0.3.1900000450
+        with:
+          imageName: ghcr.io/reubeno/brush/devcontainer
+          imageTag: latest
+          cacheFrom: ghcr.io/reubeno/brush/devcontainer
+          push: filter
+          refFilterForPush: refs/heads/main
+          eventFilterForPush: push
@@ -0,0 +1,77 @@
+name: "Docs"
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - main
+
+env:
+  RUST_BACKTRACE: 1
+  CARGO_TERM_COLOR: always
+  CLICOLOR: 1
+  CLICOLOR_FORCE: 1
+
+permissions:
+  contents: read
+
+# Only allow one run of the workflow per branch / PR at a time.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Check links in docs
+  check-links:
+    name: "Check links"
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Check repo-local links
+        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
+        with:
+          args: ". --offline --verbose --no-progress"
+          fail: true
+
+  # Generate docs content
+  generate-docs:
+    name: "Generate usage docs"
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Set up rust toolchain
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        with:
+          toolchain: stable
+
+      - name: Enable cargo cache
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+
+      - name: Create dirs
+        run: mkdir -p ./md ./man
+
+      - name: Build markdown info
+        run: cargo xtask gen docs markdown --out ./md/brush.md
+
+      - name: Upload markdown docs
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: docs-markdown
+          path: md
+
+      - name: Build man pages
+        run: cargo xtask gen docs man --output-dir ./man
+
+      - name: Upload man pages
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: docs-man
+          path: man
@@ -0,0 +1,29 @@
+name: Spelling
+on: [pull_request]
+
+env:
+  RUST_BACKTRACE: 1
+  CARGO_TERM_COLOR: always
+  CLICOLOR: 1
+  CLICOLOR_FORCE: 1
+
+permissions:
+  contents: read
+
+# Only allow one run of the workflow per branch / PR at a time.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  spelling:
+    name: spell-check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout brush
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Spell check repo
+        uses: crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14 # v1.48.0
@@ -0,0 +1,46 @@
+#
+# This workflow was based on https://docs.zizmor.sh/usage/#use-in-github-actions
+#
+
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+# Only allow one run of the workflow per branch / PR at a time.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  zizmor:
+    name: zizmor latest via PyPI
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # needed for SARIF uploads
+      contents: read # only needed for private repos
+      actions: read # only needed for private repos
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+
+      - name: Run zizmor 🌈
+        run: uvx zizmor --format=sarif . > results.sarif
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        with:
+          sarif_file: results.sarif
+          category: zizmor