From ddaa2084013a320130926d9c3100d6149df970cb Mon Sep 17 00:00:00 2001
From: Nikolay Govorov <me@govorov.online>
Date: Sun, 30 Aug 2026 03:11:19 +0100
Subject: Unify CI checks, migrate from github to gilti

---
 .dockerignore               |  9 ++++++++
 .github/workflows/build.yml | 15 +++++++++++---
 .github/workflows/legal.yml |  1 +
 .gitignore                  |  2 +-
 .mailmap                    |  3 +++
 Cargo.toml                  |  2 +-
 images/alpine/genimg        | 14 ++++++-------
 images/debian/genimg        | 18 +++++++++-------
 images/fedora/genimg        |  9 +++++++-
 images/ubuntu/genimg        | 15 ++++++++++----
 mise.lock                   | 41 ++++++++++++++++++++++++++++++++++++-
 mise.toml                   |  8 +++-----
 12 files changed, 107 insertions(+), 30 deletions(-)
 create mode 100644 .dockerignore

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..53e5ab1
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,9 @@
+# SPDX-FileCopyrightText: 2026 Nikolay Govorov
+# SPDX-License-Identifier: Apache-2.0
+
+.git
+.github
+.recluse-state
+dist
+target
+*.lcov
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c908213..be7c3ff 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -6,14 +6,20 @@ name: Build
 on:
   push:
     branches: [main]
+    tags: ["v*"]
   pull_request:
     branches: [main]
 
 permissions:
   contents: read
 
+concurrency:
+  group: hule-build-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CARGO_TERM_COLOR: always
+  RELEASE_TAG: nightly
 
 jobs:
   lint:
@@ -28,13 +34,16 @@ jobs:
           experimental: true
           install: false
       - name: Install dependencies
-        run: mise bootstrap --locked --yes
+        run: mise bootstrap --locked --yes --update
       - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
 
-      - name: Check formatting
+      - name: formatting
         run: cargo fmt --all --check
 
-      - name: Run Clippy
+      - name: shellcheck
+        run: shellcheck images/*/genimg
+
+      - name: clippy
         run: cargo clippy --workspace --all-targets --all-features --release --locked -- -D warnings
 
   build:
diff --git a/.github/workflows/legal.yml b/.github/workflows/legal.yml
index 2886f52..b5a2fad 100644
--- a/.github/workflows/legal.yml
+++ b/.github/workflows/legal.yml
@@ -6,6 +6,7 @@ name: Legal
 on:
   push:
     branches: [main]
+    tags: ["v*"]
   pull_request:
     branches: [main]
 
diff --git a/.gitignore b/.gitignore
index ba46a2d..ea96d7d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,8 +1,8 @@
 # SPDX-FileCopyrightText: 2026 Nikolay Govorov
 # SPDX-License-Identifier: Apache-2.0
 
-/target
 /dist
+/target
 mise.local.toml
 mise.*.local.toml
 
diff --git a/.mailmap b/.mailmap
index d8e0402..d364a7b 100644
--- a/.mailmap
+++ b/.mailmap
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 Nikolay Govorov
+# SPDX-License-Identifier: Apache-2.0
+#
 # Add new entries in alphabetical order
 
 Nikolay Govorov <me@govorov.online>
diff --git a/Cargo.toml b/Cargo.toml
index 6c27a41..825ad03 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -11,7 +11,7 @@ edition = "2024"
 version = "0.1.0"
 license = "Apache-2.0"
 authors = ["Nikolay Govorov <me@govorov.online>"]
-repository = "https://github.com/dimidiumlabs/hule"
+repository = "https://git.dimidiumlabs.io/hule"
 
 [workspace.dependencies]
 # local dependencies
diff --git a/images/alpine/genimg b/images/alpine/genimg
index 6d34e3e..f5446ce 100755
--- a/images/alpine/genimg
+++ b/images/alpine/genimg
@@ -56,7 +56,7 @@ qemu-img create -f qcow2 -o compat=1.1 "$out"/root.hmi "${size_gib}G"
 modprobe nbd max_part=16
 qemu-nbd --connect=/dev/nbd0 "$out"/root.hmi
 for i in $(seq 1 5); do
-	sleep 0.$i
+	sleep "0.$i"
 	partprobe /dev/nbd0 && break
 done
 trap cleanup EXIT
@@ -82,13 +82,13 @@ swapon /dev/nbd0p2
 
 # TODO: Remove bash
 apk add -U \
-	-X http://dl-cdn.alpinelinux.org/alpine/$release/main/ \
-	-X http://dl-cdn.alpinelinux.org/alpine/$release/community/ \
+	-X "http://dl-cdn.alpinelinux.org/alpine/$release/main/" \
+	-X "http://dl-cdn.alpinelinux.org/alpine/$release/community/" \
 	--allow-untrusted \
 	--arch="$apk_arch" \
 	--root=/mnt \
 	--initdb \
-	acct alpine-base alpine-conf alpine-sdk linux-firmware-none $linux \
+	acct alpine-base alpine-conf alpine-sdk linux-firmware-none "$linux" \
 	git mercurial openssh sudo syslinux tzdata gnupg haveged bash curl \
 	doas qemu-guest-agent
 
@@ -200,11 +200,11 @@ cat >/mnt/etc/docker/daemon.json <<EOF
 EOF
 
 pkg_version() {
-	name=$(run_root apk list $1 | grep installed | cut -d' ' -f1)
-	echo ${name##$1-}
+	name=$(run_root apk list "$1" | grep installed | cut -d' ' -f1)
+	echo "${name##"$1"-}"
 }
 
-run_root apk add $linux=$(pkg_version $linux)
+run_root apk add "$linux=$(pkg_version "$linux")"
 
 sync
 
diff --git a/images/debian/genimg b/images/debian/genimg
index c710088..2dedba5 100755
--- a/images/debian/genimg
+++ b/images/debian/genimg
@@ -21,19 +21,16 @@ case $arch in
 amd64)
 	darch=amd64
 	iface=ens3
-	qarch=x86_64
 	kpkg=linux-image-amd64
 	;;
 arm64)
 	darch=arm64
 	iface=enp0s1
-	qarch=aarch64
 	kpkg=linux-image-arm64
 	;;
 ppc64le)
 	darch=ppc64el
 	iface=enp0s0
-	qarch=ppc64le
 	kpkg=linux-image-powerpc64le
 	;;
 *)
@@ -67,7 +64,7 @@ qemu-img create -f qcow2 -o compat=1.1 "$out/root.hmi" "${size_gib}G"
 modprobe nbd max_part=16
 qemu-nbd --connect=/dev/nbd0 "$out/root.hmi"
 for i in $(seq 1 5); do
-	sleep 0.$i
+	sleep "0.$i"
 	partprobe /dev/nbd0 && break
 done
 trap cleanup EXIT
@@ -91,9 +88,9 @@ mkdir /mnt/boot
 mount /dev/nbd0p1 /mnt/boot
 
 if [ "$arch" = "amd64" ]; then
-	debootstrap --include=gnupg2 --arch=$darch $release /mnt
+	debootstrap --include=gnupg2 --arch="$darch" "$release" /mnt
 else
-	./qemu-debootstrap --include=gnupg2 --arch=$darch $release /mnt
+	./qemu-debootstrap --include=gnupg2 --arch="$darch" "$release" /mnt
 fi
 
 mount --bind /dev /mnt/dev
@@ -159,7 +156,14 @@ EOF
 
 run_root update-initramfs -u
 
-linuxver=$(ls /mnt/boot | grep vmlinuz | cut -d- -f2-)
+kernel_path=
+for candidate in /mnt/boot/vmlinuz-*; do
+	[ -e "$candidate" ] || continue
+	kernel_path=$candidate
+	break
+done
+[ -n "$kernel_path" ]
+linuxver=${kernel_path##*/vmlinuz-}
 
 # Reference partitions by PARTUUID so boot survives whatever the VMM names the
 # disk. cmdline is canonical: identical for every boot protocol (extlinux append
diff --git a/images/fedora/genimg b/images/fedora/genimg
index eff48da..8215ec5 100755
--- a/images/fedora/genimg
+++ b/images/fedora/genimg
@@ -150,7 +150,14 @@ run_root dnf clean all
 cat >/mnt/etc/dracut.conf.d/virtio-blk.conf <<EOF
 add_drivers="virtio-blk"
 EOF
-kernel_version=$(ls /mnt/boot | grep "vmlinuz.*.$fedora_arch" | cut -d- -f2-)
+kernel_path=
+for candidate in /mnt/boot/vmlinuz-*."$fedora_arch"; do
+	[ -e "$candidate" ] || continue
+	kernel_path=$candidate
+	break
+done
+[ -n "$kernel_path" ]
+kernel_version=${kernel_path##*/vmlinuz-}
 run_root dracut --force --kver "$kernel_version"
 
 run_root grub2-install --target=i386-pc $NBD_DEVICE
diff --git a/images/ubuntu/genimg b/images/ubuntu/genimg
index ec4b26c..1980803 100755
--- a/images/ubuntu/genimg
+++ b/images/ubuntu/genimg
@@ -81,7 +81,7 @@ export DEBIAN_FRONTEND=noninteractive
 
 debootstrap \
 	--include=gnupg,ubuntu-keyring \
-	--arch=$arch $release \
+	--arch="$arch" "$release" \
 	/mnt http://archive.ubuntu.com/ubuntu/
 
 mount --bind /dev /mnt/dev
@@ -111,9 +111,9 @@ echo 'nameserver 1.1.1.1' >>/mnt/etc/resolv.conf
 net_mode=static
 net_address=10.0.2.15/24
 net_gateway=10.0.2.2
-cat >/mnt/etc/systemd/network/25-ens3.network <<EOF
+cat >"/mnt/etc/systemd/network/25-$iface.network" <<EOF
 [Match]
-Name=ens3
+Name=$iface
 
 [Network]
 Address=$net_address
@@ -172,7 +172,14 @@ EOF
 
 run_root update-initramfs -u
 
-linuxver=$(ls /mnt/boot | grep 'vmlinuz-[0-9].*' | cut -d- -f2-)
+kernel_path=
+for candidate in /mnt/boot/vmlinuz-[0-9]*; do
+	[ -e "$candidate" ] || continue
+	kernel_path=$candidate
+	break
+done
+[ -n "$kernel_path" ]
+linuxver=${kernel_path##*/vmlinuz-}
 
 # Reference partitions by PARTUUID so boot works regardless of how the VMM names
 # the disk (vda/sda/nvme...). cmdline is canonical: identical for every boot
diff --git a/mise.lock b/mise.lock
index b2218ec..2fbf86b 100644
--- a/mise.lock
+++ b/mise.lock
@@ -5,5 +5,44 @@ version = "1.97.1"
 backend = "core:rust"
 
 [tools.rust.options]
-components = "clippy,rustfmt"
+components = "clippy,llvm-tools-preview,rustfmt"
 profile = "minimal"
+
+[[tools.shellcheck]]
+version = "0.11.0"
+backend = "aqua:koalaman/shellcheck"
+
+[tools.shellcheck."platforms.linux-arm64"]
+checksum = "sha256:12b331c1d2db6b9eb13cfca64306b1b157a86eb69db83023e261eaa7e7c14588"
+url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.linux.aarch64.tar.xz"
+url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056934"
+
+[tools.shellcheck."platforms.linux-arm64-musl"]
+checksum = "sha256:12b331c1d2db6b9eb13cfca64306b1b157a86eb69db83023e261eaa7e7c14588"
+url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.linux.aarch64.tar.xz"
+url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056934"
+
+[tools.shellcheck."platforms.linux-x64"]
+checksum = "sha256:8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198"
+url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.linux.x86_64.tar.xz"
+url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056942"
+
+[tools.shellcheck."platforms.linux-x64-musl"]
+checksum = "sha256:8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198"
+url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.linux.x86_64.tar.xz"
+url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056942"
+
+[tools.shellcheck."platforms.macos-arm64"]
+checksum = "sha256:56affdd8de5527894dca6dc3d7e0a99a873b0f004d7aabc30ae407d3f48b0a79"
+url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.darwin.aarch64.tar.xz"
+url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056932"
+
+[tools.shellcheck."platforms.macos-x64"]
+checksum = "sha256:3c89db4edcab7cf1c27bff178882e0f6f27f7afdf54e859fa041fca10febe4c6"
+url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.darwin.x86_64.tar.xz"
+url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056930"
+
+[tools.shellcheck."platforms.windows-x64"]
+checksum = "sha256:8a4e35ab0b331c85d73567b12f2a444df187f483e5079ceffa6bda1faa2e740e"
+url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.zip"
+url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056944"
diff --git a/mise.toml b/mise.toml
index 52628fd..9d541da 100644
--- a/mise.toml
+++ b/mise.toml
@@ -7,13 +7,11 @@ min_version = "2026.7.5"
 experimental = true
 
 [tools]
-rust = { version = "1.97.1", profile = "minimal", components = [
-  "clippy",
-  "rustfmt",
-] }
+rust = { version = "1.97.1", profile = "minimal", components = [ "clippy", "llvm-tools-preview", "rustfmt" ] }
+shellcheck = "0.11.0"
 
 [task_config]
 dir = "{{cwd}}"
 includes = [
-  "git::https://github.com/dimidiumlabs/platform.git//tasks?ref=e5ca3be4349af3d1da2dde9d1165d52fb014a371",
+  "git::https://git.dimidiumlabs.io/platform.git//tasks?ref=e5ca3be4349af3d1da2dde9d1165d52fb014a371",
 ]
-- 
Gilti