Move to new just system

.editorconfig

@@ -0,0 +1,57 @@
+# DO NOT EDIT MANUALLY.
+# This file is common to all projects and managed by limen.
+# Global configuration changes proposals can be discussed on https://github.com/farcloser/limen
+
+# https://editorconfig.org
+root = true
+
+[*]
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+indent_style = space
+indent_size = 2
+
+# --- whitespace-significant formats ---
+[*.{diff,patch}]
+trim_trailing_whitespace = false
+
+[*.md]
+trim_trailing_whitespace = false
+
+# --- Go: tabs, rendered 4 wide (gofmt emits tabs; width is display-only) ---
+[*.go]
+indent_style = tab
+indent_size = 4
+
+# --- task runner / build ---
+[{Justfile,justfile,.justfile}]
+indent_size = 4
+
+[*.just]
+indent_size = 4
+
+[Makefile]
+indent_style = tab
+
+# --- data formats (YAML must be spaces, never tabs) ---
+[*.{json,jsonc,yaml,yml,toml}]
+indent_size = 2
+
+# --- JavaScript / TypeScript (2-space matches Prettier/Biome defaults) ---
+[*.{js,cjs,mjs,jsx,ts,cts,mts,tsx}]
+indent_size = 2
+
+# --- CSS family ---
+[*.{css,scss,sass,less,pcss}]
+indent_size = 2
+
+# --- HTML / templates ---
+[*.{html,htm,vue,svelte,astro}]
+indent_size = 2
+
+# --- Rust: rustfmt is 4-space, 100-col ---
+[*.rs]
+indent_size = 4
+max_line_length = 100

.gitignore

@@ -2,4 +2,26 @@
 .idea
 _*
 bin
-third-party
+third-party
+
+# --- added by limen fix: baseline patterns ---
+Thumbs.db
+Desktop.ini
+.vscode/
+*.swp
+*~
+*.local
+_scratch/
+WIP_*
+/build
+/target/
+**/*.rs.bk
+*.pdb
+node_modules/
+.svelte-kit/
+.vite/
+vite.config.*.timestamp-*
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*

.golangci.yml

@@ -199,10 +199,10 @@ linters:
   settings:
     govet:
       enable:
-        # Struct fields ordered to minimize padding waste. Off by default in
-        # vet; reordering is safe for us — nothing relies on field order or
-        # memory layout (JSON marshals by name).
-        # - fieldalignment
+      # Struct fields ordered to minimize padding waste. Off by default in
+      # vet; reordering is safe for us — nothing relies on field order or
+      # memory layout (JSON marshals by name).
+      # - fieldalignment
     # Note: default, no changes
     errorlint:
       # Disable err==target → errors.Is(err, target) auto-rewrite. The fixer
@@ -251,32 +251,32 @@ linters:
         - assign-exclusive # Only allow cuddling new OR existing variables, not both
         - assign-expr # Don't allow assignments cuddled with expressions
 
-#    forbidigo:
-#      forbid:
-#        - pattern: '^fmt\.Print(ln|f)?$'
-#          msg: "use structured logging instead"
-#        - pattern: '^os\.ReadFile$'
-#          msg: "use xos.ReadFile instead"
-#        - pattern: '^os\.ReadDir$'
-#          msg: "use xos.ReadDir instead"
-#        - pattern: '^os\.WriteFile$'
-#          msg: "use filesystem.WriteFile instead"
-#        - pattern: '^os\.Stat$'
-#          msg: "use xos.Stat instead"
-#        - pattern: '^os\.Open$'
-#          msg: "use xos.Open instead"
-#        - pattern: '^os\.OpenFile$'
-#          msg: "use xos.OpenFile instead"
-#        - pattern: '^os\.Create$'
-#          msg: "use xos.OpenFile instead"
-#        - pattern: '^os\.CreateTemp$'
-#          msg: "use xos.CreateTemp instead"
-#        - pattern: '^os\.MkdirTemp$'
-#          msg: "use xos.MkdirTemp instead"
-#        - pattern: '^os\.Truncate$'
-#          msg: "use xos.Truncate instead"
-#        - pattern: '^os\.UserHomeDir$'
-#          msg: "use filesystem.HomeDir instead"
+      #    forbidigo:
+      #      forbid:
+      #        - pattern: '^fmt\.Print(ln|f)?$'
+      #          msg: "use structured logging instead"
+      #        - pattern: '^os\.ReadFile$'
+      #          msg: "use xos.ReadFile instead"
+      #        - pattern: '^os\.ReadDir$'
+      #          msg: "use xos.ReadDir instead"
+      #        - pattern: '^os\.WriteFile$'
+      #          msg: "use filesystem.WriteFile instead"
+      #        - pattern: '^os\.Stat$'
+      #          msg: "use xos.Stat instead"
+      #        - pattern: '^os\.Open$'
+      #          msg: "use xos.Open instead"
+      #        - pattern: '^os\.OpenFile$'
+      #          msg: "use xos.OpenFile instead"
+      #        - pattern: '^os\.Create$'
+      #          msg: "use xos.OpenFile instead"
+      #        - pattern: '^os\.CreateTemp$'
+      #          msg: "use xos.CreateTemp instead"
+      #        - pattern: '^os\.MkdirTemp$'
+      #          msg: "use xos.MkdirTemp instead"
+      #        - pattern: '^os\.Truncate$'
+      #          msg: "use xos.Truncate instead"
+      #        - pattern: '^os\.UserHomeDir$'
+      #          msg: "use filesystem.HomeDir instead"
 
       exclude-godoc-examples: true
       analyze-types: true

.just/.shellcheckrc

@@ -0,0 +1,17 @@
+# DO NOT EDIT MANUALLY.
+# This file is common to all projects and managed by limen.
+# If you need local overrides for this project, you can use inline `# shellcheck disable=SCXXXX`.
+# Global configuration changes proposals can be discussed on https://github.com/farcloser/limen
+
+# .shellcheckrc — https://www.shellcheck.net/wiki/
+
+# Follow `source`/`.`-ed files so shellcheck checks across includes.
+# 'true' lets it follow even non-constant source paths (best for repos with libs).
+external-sources=true
+
+# Opt INTO the optional checks shellcheck ships but doesn't run by default.
+enable=quote-safe-variables   # flags unquoted vars that should be quoted
+# enable=require-variable-braces # enforce ${var} consistently (optional/stylistic — drop if noisy)
+enable=check-unassigned-uppercase
+enable=deprecate-which         # `which` → `command -v`
+enable=avoid-nullary-conditions

.just/.yamlfmt

@@ -0,0 +1,44 @@
+# DO NOT EDIT MANUALLY.
+# This file is common to all projects and managed by limen.
+# Global configuration changes proposals can be discussed on https://github.com/farcloser/limen
+
+# .yamlfmt — https://github.com/google/yamlfmt
+# Formatter: the 'basic' formatter is the only one; these are its options.
+formatter:
+  type: basic
+
+  # --- indentation ---
+  indent: 2                      # match your .editorconfig (2-space YAML)
+  include_document_start: false  # don't force a leading `---` on every file
+
+  # --- the defaults worth overriding ---
+  retain_line_breaks_single: true  # collapse runs of blank lines to ONE, but keep
+                                   # intentional single blank lines (readability).
+                                   # Prefer this over retain_line_breaks, which keeps
+                                   # *all* blank lines and barely normalizes anything.
+
+  scan_folded_as_literal: false    # leave folded (>) scalars folded; don't rewrite to literal (|)
+
+  # --- correctness / safety ---
+  disallow_anchors: false          # set true ONLY if you want to forbid &anchors/*aliases
+  max_line_length: 0               # 0 = no wrapping. Leave OFF — yamlfmt's wrapping is
+                                   # crude and mangles long values; let humans wrap.
+
+  # --- quoting / strings: leave alone ---
+  # yamlfmt is deliberately light on string normalization. Don't fight it; it won't
+  # aggressively re-quote, which is the safe default for mixed YAML (k8s, CI, etc.)
+
+# --- which files to format ---
+include:
+  - "**/*.{yaml,yml}"
+
+gitignore_excludes: true
+
+exclude:
+  - ".git/**"
+  - "**/vendor/**"
+  - "**/testdata/**"        # don't reformat fixtures — tests may assert exact bytes
+  - "**/*.gen.{yaml,yml}"   # leave generated YAML alone
+
+# Continue formatting other files if one fails to parse, and report all errors.
+continue_on_error: false   # in CI you want a hard fail on malformed YAML

.just/aqua-registry.yaml

@@ -0,0 +1,79 @@
+# DO NOT EDIT MANUALLY.
+# This file is common to all projects and managed by limen.
+# Most tools can be installed directly from aqua registry without local overrides.
+# Addition of non-standard tools can be discussed on https://github.com/farcloser/limen
+
+packages:
+  # The /v2 module-path suffix is mandatory (Go semantic import versioning):
+  # `go install github.com/google/go-licenses@v2.x` is rejected by the
+  # toolchain. Go strips the /v2 when naming the binary; files spells it out.
+  - type: go_install
+    path: github.com/google/go-licenses/v2
+    description: Report on the licenses of a Go project's dependencies
+    version_source: github_tag
+    files:
+      - name: go-licenses
+  - type: go_install
+    path: github.com/vbatts/git-validation
+    description: Validate git commit rules (DCO sign-off, subject length, …)
+    version_source: github_tag
+  # Graphviz `dot` as a single static Go binary: the real graphviz C code
+  # compiled to WASM, executed via wazero — no C toolchain, no shared
+  # libraries, which is why this can live in aqua while system graphviz
+  # cannot. Renders the PNGs of `just test go profile`. The cmd/dot module is
+  # nested and untagged upstream, hence the explicit repo and the
+  # pseudo-version pin in aqua.yaml.
+  - type: go_install
+    name: github.com/goccy/go-graphviz/cmd/dot
+    path: github.com/goccy/go-graphviz/cmd/dot
+    repo_owner: goccy
+    repo_name: go-graphviz
+    description: Graphviz dot CLI, pure-Go build (WASM via wazero)
+    version_source: github_tag
+  # The Go team distributes govulncheck via `go install` only, by policy. The
+  # repo is not inferable from the golang.org import path, hence the explicit
+  # owner/name (same as the standard registry does for gopls).
+  - type: go_install
+    name: golang.org/x/vuln/cmd/govulncheck
+    path: golang.org/x/vuln/cmd/govulncheck
+    repo_owner: golang
+    repo_name: vuln
+    description: Scan dependencies against the Go vulnerability database
+    version_source: github_tag
+  # Same golang.org path situation as govulncheck: explicit name and repo.
+  - type: go_install
+    name: golang.org/x/tools/cmd/deadcode
+    path: golang.org/x/tools/cmd/deadcode
+    repo_owner: golang
+    repo_name: tools
+    description: Whole-program detection of unreachable functions
+    version_source: github_tag
+  # hadolint as pure Go, from the farcloser stable. The binary is the nested
+  # cmd/godolint package of the root module — explicit name and repo, same
+  # shape as go-graphviz's cmd/dot above (tags live at the repo root).
+  - type: go_install
+    name: github.com/farcloser/godolint/cmd/godolint
+    path: github.com/farcloser/godolint/cmd/godolint
+    repo_owner: farcloser
+    repo_name: godolint
+    description: Lint Dockerfiles (a pure-Go port of hadolint)
+    version_source: github_tag
+  # limen itself: every repo pins the version that enforces it, so the binary
+  # and the canonical files it embeds travel together (no version skew between
+  # the checker and the checked). Graduates to the standard registry once
+  # farcloser/limen is registered there.
+  - type: github_release
+    repo_owner: farcloser
+    repo_name: limen
+    description: Verify a repository against Farcloser engineering rules
+    asset: limen_{{trimV .Version}}_{{.OS}}_{{.Arch}}.tar.gz
+    format: tar.gz
+    files:
+      - name: limen
+    checksum:
+      type: github_release
+      asset: checksums.txt
+      algorithm: sha256
+    supported_envs:
+      - darwin
+      - linux