Harden repo security checks and rename christianlempa assets to smartmur

Author: SmartMur

.github/workflows/ci.yml

@@ -13,6 +13,17 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.x"
+
+      - name: Install pre-commit
+        run: python -m pip install --upgrade pip pre-commit
+
+      - name: Pre-commit checks
+        run: pre-commit run --all-files --show-diff-on-failure
+
       - name: Shell syntax checks
         run: |
           bash -n bootstrap.sh

.gitignore

@@ -1 +1,44 @@
+# macOS
 .DS_Store
+.AppleDouble
+.LSOverride
+Icon?
+
+# Editor and swap files
+*.swp
+*.swo
+*~
+
+# Logs and temporary files
+*.log
+*.tmp
+*.temp
+*.bak
+*.orig
+
+# Python caches
+__pycache__/
+*.py[cod]
+.mypy_cache/
+.pytest_cache/
+
+# Local environment and secret material
+.env
+.env.*
+!.env.example
+.envrc
+*.pem
+*.key
+*.p12
+*.pfx
+*.kdbx
+*.ovpn
+*.agekey
+*.asc
+secrets.*
+*.secret
+
+# Local shell overrides (never tracked)
+zsh/.zshrc.local
+zsh/.zsh/secrets.zsh
+zsh/.zsh/private.zsh

.pre-commit-config.yaml

@@ -0,0 +1,16 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: check-merge-conflict
+      - id: detect-private-key
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+
+  - repo: local
+    hooks:
+      - id: security-scrub
+        name: security scrub (working tree)
+        entry: python3 scripts/security_scrub.py --no-history
+        language: system
+        pass_filenames: false

CONTRIBUTING.md

@@ -10,11 +10,19 @@ cd dotfiles
 ./install.sh --skip-brew
 ```
 
+Install local hooks once:
+
+```bash
+brew install pre-commit
+pre-commit install
+```
+
 ## Required Checks Before PR
 
 ```bash
 bash -n bootstrap.sh
 bash -n install.sh
+pre-commit run --all-files
 python3 scripts/security_scrub.py --no-history
 ```
 

Makefile

@@ -1,4 +1,4 @@
-.PHONY: install bootstrap lint security check
+.PHONY: install bootstrap lint security hooks precommit check
 
 install:
 	./install.sh
@@ -13,4 +13,10 @@ lint:
 security:
 	python3 scripts/security_scrub.py
 
-check: lint security
+hooks:
+	pre-commit install
+
+precommit:
+	pre-commit run --all-files
+
+check: lint security precommit

README.md

@@ -12,15 +12,16 @@
 [![Shell](https://img.shields.io/badge/Shell-Zsh-89e051)](https://www.zsh.org/)
 [![License](https://img.shields.io/badge/License-MIT-22c55e.svg)](LICENSE)
 [![Repo](https://img.shields.io/badge/GitHub-SmartMur%2Fdotfiles-181717?logo=github)](https://github.com/SmartMur/dotfiles)
+[![pre-commit](https://img.shields.io/badge/pre--commit-enabled-1f6feb?logo=pre-commit)](https://pre-commit.com/)
 
 Production-ready macOS terminal dotfiles with reproducible setup, safe backups, Homebrew package management, and iTerm2 profile/theme automation.
 
 ![Terminal Preview](assets/images/terminal-preview.svg)
 
-Start here: `docs/GETTING_STARTED.md`  
-Contributing: `CONTRIBUTING.md`  
-Security policy: `SECURITY.md`  
-Security rulebook: `docs/SECURITY_RULEBOOK.md`  
+Start here: `docs/GETTING_STARTED.md`
+Contributing: `CONTRIBUTING.md`
+Security policy: `SECURITY.md`
+Security rulebook: `docs/SECURITY_RULEBOOK.md`
 Roadmap: `ROADMAP.md`
 
 ## Overview
@@ -44,14 +45,14 @@ This repository captures your preferred terminal environment so it can be applie
 ├── assets/images/
 ├── config/.config/
 │   ├── iterm2/
-│   └── starship.christianlempa.toml
+│   └── starship.smartmur.toml
 └── zsh/
     ├── .zshrc
     └── .zsh/
-        ├── aliases.christianlempa.zsh
-        ├── functions.christianlempa.zsh
-        ├── nvm.christianlempa.zsh
-        └── starship.christianlempa.zsh
+        ├── aliases.smartmur.zsh
+        ├── functions.smartmur.zsh
+        ├── nvm.smartmur.zsh
+        └── starship.smartmur.zsh
 ```
 
 ## Requirements
@@ -80,11 +81,19 @@ exec zsh
 ```bash
 bash -n bootstrap.sh
 bash -n install.sh
+pre-commit run --all-files
 python3 scripts/security_scrub.py
 ```
 
 If a leak is detected, stop and follow `docs/SECURITY_RULEBOOK.md` before any push.
 
+Install hooks once per clone:
+
+```bash
+brew install pre-commit
+pre-commit install
+```
+
 ## Dependabot PR Automation
 
 Dependabot PRs are auto-managed by:
@@ -111,10 +120,10 @@ The bootstrap script installs prerequisites if needed, clones this repo into `~/
 ## iTerm2 and Branding
 
 - Dynamic profile location:
-  - `~/Library/Application Support/iTerm2/DynamicProfiles/christianlempa.dynamic.json`
+  - `~/Library/Application Support/iTerm2/DynamicProfiles/smartmur.dynamic.json`
 - Additional profile assets:
-  - `~/.config/iterm2/christianlempa.itermcolors`
-  - `~/.config/iterm2/christianlempa-profile.json`
+  - `~/.config/iterm2/smartmur.itermcolors`
+  - `~/.config/iterm2/smartmur-profile.json`
 
 Brand assets copied from `https://smartmur.ca` on February 18, 2026:
 
@@ -125,7 +134,7 @@ Brand assets copied from `https://smartmur.ca` on February 18, 2026:
 
 - Core shell behavior: `zsh/.zshrc`
 - Aliases/functions modules: `zsh/.zsh/*`
-- Prompt style: `config/.config/starship.christianlempa.toml`
+- Prompt style: `config/.config/starship.smartmur.toml`
 - Package list: `Brewfile`
 
 After changing files in this repo:

SECURITY.md

@@ -33,6 +33,7 @@ If a secret is exposed:
 2. Remove secret from current branch.
 3. Rewrite history if needed.
 4. Re-run:
+   - `pre-commit run --all-files`
    - `python3 scripts/security_scrub.py`
    - `bash -n bootstrap.sh`
    - `bash -n install.sh`
@@ -42,6 +43,7 @@ Use `docs/SECURITY_RULEBOOK.md` for command-level incident steps.
 
 ## Baseline Security Checks
 
+- `pre-commit run --all-files`
 - `scripts/security_scrub.py`
 - `bash -n bootstrap.sh`
 - `bash -n install.sh`

…onfig/iterm2/christianlempa-profile.json …fig/.config/iterm2/smartmur-profile.jsonconfig/.config/iterm2/christianlempa-profile.json renamed to config/.config/iterm2/smartmur-profile.json config/.config/iterm2/christianlempa-profile.json renamed to config/.config/iterm2/smartmur-profile.json

@@ -385,4 +385,4 @@
     "Alpha Component" : 1,
     "Green Component" : 0.51372549019607838
   }
-}
+}

…onfig/iterm2/christianlempa.dynamic.json …fig/.config/iterm2/smartmur.dynamic.jsonconfig/.config/iterm2/christianlempa.dynamic.json renamed to config/.config/iterm2/smartmur.dynamic.json config/.config/iterm2/christianlempa.dynamic.json renamed to config/.config/iterm2/smartmur.dynamic.json

@@ -85,7 +85,7 @@
       "Prompt Before Closing 2": false,
       "BM Growl": true,
       "Command": "",
-      "Description": "ChristianLempa",
+      "Description": "SmartMur",
       "Space": 0,
       "Mouse Reporting": true,
       "Screen": -1,
@@ -321,7 +321,7 @@
         "Alpha Component": 1,
         "Green Component": 0.78431372549019607
       },
-      "Name": "ChristianLempa",
+      "Name": "SmartMur",
       "Cursor Text Color": {
         "Green Component": 1,
         "Red Component": 1,