chore(release): 1.1.0

.github/workflows/ci.yml

@@ -19,13 +19,17 @@ jobs:
       - uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1
         with:
           version: 2026.9.18 # mise version, updated by Renovate
-      - run: pnpm install --frozen-lockfile
+      # The CLI only: the documentation site (docs/) is built by the docs job.
+      - run: pnpm install --frozen-lockfile --filter configfile
       - run: pnpm lint
       - run: pnpm typecheck
       - name: Check the workflows
         run: |
           actionlint
           zizmor --persona regular .github/workflows
+      - name: Check the install script
+        # Served at https://docs.configfile.sh/install.sh, run by any POSIX shell.
+        run: shellcheck --shell=sh docs/public/install.sh
 
   test:
     strategy:
@@ -46,7 +50,8 @@ jobs:
           version: 2026.9.18 # mise version, updated by Renovate
           # One cache per Node.js version: the override is not part of mise.toml.
           cache_key_prefix: mise-node-${{ matrix.node }}
-      - run: pnpm install --frozen-lockfile
+      # The CLI only: the documentation site (docs/) is built by the docs job.
+      - run: pnpm install --frozen-lockfile --filter configfile
       - run: pnpm test:coverage
 
   package:
@@ -59,7 +64,8 @@ jobs:
       - uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1
         with:
           version: 2026.9.18 # mise version, updated by Renovate
-      - run: pnpm install --frozen-lockfile
+      # The CLI only: the documentation site (docs/) is built by the docs job.
+      - run: pnpm install --frozen-lockfile --filter configfile
       - run: pnpm pack --out "$RUNNER_TEMP/configfile.tgz"
       - name: Check npm publishes package.json as written
         # npm publish silently drops what it considers invalid (a "./" bin path
@@ -78,3 +84,69 @@ jobs:
           configfile --version
           configfile --help
           HOME="$RUNNER_TEMP/home" configfile history
+
+  binary:
+    # Builds the standalone binary on each system it is made for, as
+    # publish.yml does for a release, and runs the end-to-end tests with it.
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, ubuntu-24.04-arm, macos-15, macos-15-intel]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1
+        with:
+          version: 2026.9.18 # mise version, updated by Renovate
+      # The CLI only: the documentation site (docs/) is built by the docs job.
+      - run: pnpm install --frozen-lockfile --filter configfile
+      - run: pnpm build:binary
+      - name: Install the binary with the install script
+        # As users get it: from a release laid out as on GitHub, with SHA256SUMS.
+        run: |
+          archive=$(ls release/configfile-*.tar.gz)
+          name=$(basename "$archive")
+          tar -tzf "$archive" | sort > "$RUNNER_TEMP/members"
+          printf '%s\n' ./ ./LICENSE ./THIRD-PARTY-LICENSES ./configfile | sort |
+            diff - "$RUNNER_TEMP/members"
+          release="$RUNNER_TEMP/releases/download/ci"
+          mkdir -p "$release"
+          cp "$archive" "$release/"
+          (cd "$release" && shasum -a 256 "$name" > SHA256SUMS)
+          CONFIGFILE_DOWNLOAD_URL="file://$RUNNER_TEMP/releases" CONFIGFILE_VERSION=ci \
+            CONFIGFILE_INSTALL_DIR="$RUNNER_TEMP/bin" sh docs/public/install.sh
+      - name: Run the end-to-end tests with the installed binary
+        run: CONFIGFILE_BINARY="$RUNNER_TEMP/bin/configfile" pnpm vitest run tests/e2e.test.ts
+      - name: Answer a question on a terminal, whatever NODE_OPTIONS says
+        run: |
+          bin="$RUNNER_TEMP/bin/configfile"
+          export HOME="$RUNNER_TEMP/home" NODE_OPTIONS="--require /nonexistent.js"
+          mkdir -p "$HOME"
+          remote="$RUNNER_TEMP/remote"
+          git init --quiet "$remote"
+          git -C "$remote" -c user.name=ci -c user.email=ci@example.com commit --quiet --allow-empty -m first
+          # The URL is typed once the question is shown; the input stays open meanwhile.
+          answer() { sleep 3; printf '%s\r' "$remote"; sleep 10; }
+          if [ "$RUNNER_OS" = macOS ]; then
+            answer | script -q /dev/null "$bin" init
+          else
+            answer | script -qec "$bin init" /dev/null
+          fi
+          grep -F "$remote" "$HOME/.configfilerc"
+
+  docs:
+    # Builds the documentation site (docs/), as docs-deploy.yml publishes it.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0 # the pages show when they were last updated, from git
+          persist-credentials: false
+      - uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1
+        with:
+          version: 2026.9.18 # mise version, updated by Renovate
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --filter configfile-docs typecheck
+      - run: pnpm docs:build

.github/workflows/docs-deploy.yml

@@ -0,0 +1,56 @@
+name: Docs
+
+# Publishes the documentation site (docs/) to GitHub Pages, served at
+# https://docs.configfile.sh. It runs on pushes to master, the branch of
+# released versions (git-flow), so the site describes the latest release. It
+# can also be run by hand from the Actions tab, to publish master again.
+#
+# Set up once in the repository settings: Pages > Source: GitHub Actions,
+# custom domain docs.configfile.sh, Enforce HTTPS. The github-pages
+# environment only accepts deployments from master.
+
+on:
+  push:
+    branches: [master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# One deployment at a time; a newer one waits instead of cancelling.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0 # the pages show when they were last updated, from git
+          persist-credentials: false
+      # No cache: nothing restored from another run can end up on the site.
+      - uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1
+        with:
+          version: 2026.9.18 # mise version, updated by Renovate
+          cache: false
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm docs:build
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: docs/dist
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    permissions:
+      pages: write # publish the site
+      id-token: write # prove the deployment comes from this workflow
+    steps:
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+      - id: deployment
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

.github/workflows/publish.yml

@@ -4,16 +4,23 @@ name: Publish
 # master, the release branch of git-flow:
 #
 # - build: checks the tag, runs the checks and packs the package once;
-# - github-release: publishes that tarball, its SHA256SUMS and the CHANGELOG
-#   section as a GitHub release, with a build provenance attestation
-#   (`gh attestation verify configfile-<version>.tgz --repo mindsers/configfile`);
+# - binaries: builds the standalone binary on each system it is made for
+#   (tools/build-binary.ts), and runs the end-to-end tests with it;
+# - github-release: publishes that tarball, the binaries, their SHA256SUMS
+#   and the CHANGELOG section as a GitHub release, with a build provenance
+#   attestation for each archive (`gh attestation verify <archive> --repo
+#   mindsers/configfile`).
+#   The binaries keep the same names from one release to the next, so that
+#   docs/public/install.sh finds the latest one at releases/latest/download/;
 # - npm: publishes the same tarball to npm, with npm trusted publishing (no
 #   token stored, provenance statement). It only runs when the repository
 #   variable NPM_PUBLISH is "true", once trusted publishing is set up on
 #   npmjs.com (package settings > Trusted publishing): repository
 #   mindsers/configfile, workflow publish.yml, environment npm. To publish a
 #   version released while it was off, set the variable and re-run this
-#   workflow for its tag: an existing GitHub release keeps its notes.
+#   workflow for its tag: an existing GitHub release keeps its notes and the
+#   files it already has (a rebuilt archive is not byte for byte the same, and
+#   would break the checksums users have); only missing files are added.
 
 on:
   push:
@@ -44,19 +51,17 @@ jobs:
           version=$(node -p "require('./package.json').version")
           [ "$version" = "$TAG" ] || {
             echo "::error::package.json is $version, the tag is $TAG."; exit 1; }
-      - run: pnpm install --frozen-lockfile
+      # The CLI only: the documentation site (docs/) is not part of a release.
+      - run: pnpm install --frozen-lockfile --filter configfile
       - run: pnpm check
       - name: Pack the package
         env:
           TAG: ${{ github.ref_name }}
         run: |
           mkdir release
           npm pack --pack-destination release
-          cd release
-          [ -f "configfile-$TAG.tgz" ] || {
+          [ -f "release/configfile-$TAG.tgz" ] || {
             echo "::error::npm pack did not produce configfile-$TAG.tgz."; exit 1; }
-          sha256sum "configfile-$TAG.tgz" > SHA256SUMS
-          cat SHA256SUMS
       - name: Extract the release notes from the CHANGELOG
         env:
           TAG: ${{ github.ref_name }}
@@ -74,8 +79,36 @@ jobs:
           path: release/
           if-no-files-found: error
 
-  github-release:
+  binaries:
     needs: build
+    strategy:
+      matrix:
+        os: [ubuntu-24.04, ubuntu-24.04-arm, macos-15, macos-15-intel]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # No cache: nothing restored from another run can end up in a release.
+      - uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1
+        with:
+          version: 2026.9.18 # mise version, updated by Renovate
+          cache: false
+      - run: pnpm install --frozen-lockfile --filter configfile
+      - run: pnpm build:binary
+      - name: Run the end-to-end tests with the binary
+        run: |
+          mkdir "$RUNNER_TEMP/binary"
+          tar -xzf release/configfile-*.tar.gz -C "$RUNNER_TEMP/binary"
+          CONFIGFILE_BINARY="$RUNNER_TEMP/binary/configfile" pnpm vitest run tests/e2e.test.ts
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: binary-${{ matrix.os }}
+          path: release/configfile-*.tar.gz
+          if-no-files-found: error
+
+  github-release:
+    needs: [build, binaries]
     runs-on: ubuntu-latest
     permissions:
       contents: write # create the release
@@ -85,23 +118,57 @@ jobs:
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: binary-*
+          merge-multiple: true
+      - name: Keep the files of an existing release
+        id: keep
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          gh release view "$TAG" --repo "$GITHUB_REPOSITORY" --json assets \
+            --jq '.assets[].name' > published.txt 2> /dev/null || : > published.txt
+          # Kept aside until attested: only what this run built is attested.
+          mkdir published
+          grep '^configfile-' published.txt | while read -r name; do
+            rm -f "$name"
+            gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --pattern "$name" --dir published
+            echo "::notice::$name is kept as published."
+          done
+          if ls configfile-* > /dev/null 2>&1; then
+            echo "built=true" >> "$GITHUB_OUTPUT"
+          fi
+      # Attests the files built by this run only: a published file, which may
+      # have been uploaded by hand, keeps the attestation it has (if any).
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        if: steps.keep.outputs.built == 'true'
         with:
-          subject-path: configfile-${{ github.ref_name }}.tgz
+          subject-path: configfile-*
+      - name: Compute the checksums
+        run: |
+          find published -type f -exec mv {} . \;
+          sha256sum configfile-* > SHA256SUMS
+          cat SHA256SUMS
       - name: Create the GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ github.ref_name }}
         run: |
-          # A release created by hand, or by an earlier run: its notes are kept,
-          # and the files attested above replace any older ones.
+          # A release created by hand, or by an earlier run: its notes and files
+          # are kept, the missing files added, and SHA256SUMS (which covers the
+          # files as published) replaced.
           if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" > /dev/null 2>&1; then
-            gh release upload "$TAG" "configfile-$TAG.tgz" SHA256SUMS \
-              --repo "$GITHUB_REPOSITORY" --clobber
-            echo "::notice::The $TAG release already existed: its notes are kept, its files replaced."
+            for file in configfile-*; do
+              grep -qxF "$file" published.txt ||
+                gh release upload "$TAG" "$file" --repo "$GITHUB_REPOSITORY"
+            done
+            gh release upload "$TAG" SHA256SUMS --repo "$GITHUB_REPOSITORY" --clobber
+            echo "::notice::The $TAG release already existed: its notes and files are kept, missing files added."
             exit 0
           fi
-          gh release create "$TAG" "configfile-$TAG.tgz" SHA256SUMS \
+          gh release create "$TAG" configfile-* SHA256SUMS \
             --repo "$GITHUB_REPOSITORY" --verify-tag \
             --title "$TAG" --notes-file notes.md
 

.gitignore

@@ -63,3 +63,7 @@ dist/
 
 # macOS
 .DS_Store
+
+# Astro (docs/)
+.astro/
+release/

CHANGELOG.md

@@ -6,6 +6,48 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.1.0] - 2026-10-14
+### Added
+- Standalone binaries for macOS (13.5 or later) and Linux (GNU C library 2.28 or later), on x64
+  and arm64, with each release, and an install script:
+  `curl -fsSL https://docs.configfile.sh/install.sh | sh` installs configfile on a new machine
+  without Node.js or a package manager ([#301](https://github.com/mindsers/configfile/issues/301)).
+- Scripts get the repository folder, their name and the system in the `CONFIGFILE_REPO`,
+  `CONFIGFILE_SCRIPT` and `CONFIGFILE_OS` environment variables
+  ([#295](https://github.com/mindsers/configfile/issues/295)).
+- A JSON Schema for `settings.json`, at `https://docs.configfile.sh/schemas/settings.json`: with
+  `"$schema"` at the top of the file, editors complete and check it as you type.
+- A documentation site, [docs.configfile.sh](https://docs.configfile.sh), with a tutorial, guides,
+  a reference and explanations. The README is now a short introduction that links to it.
+- Modules can name scripts to run when they are deployed or undeployed, with `"pre_deploy"`,
+  `"post_deploy"`, `"pre_undeploy"` and `"post_undeploy"` in `settings.json`. A script that fails
+  stops the command there, unless `--keep-going` is given, and a `pre_` script that fails leaves
+  the files of its module as they are; `--no-hooks` runs none. A name that matches no script
+  fails the command before anything is changed. `modules status` shows the scripts
+  ([#298](https://github.com/mindsers/configfile/issues/298)).
+
+### Changed
+- `modules deploy` and `modules undeploy` work on one module at a time, taking the lock for each
+  module in turn instead of the whole run. When a local file already exists, the question to
+  replace it is asked once the other files of its module are deployed, no longer at the very end.
+
+### Fixed
+- `update` and `init` take the lock that `modules deploy` and `undeploy` use, so files are never
+  deployed while a sync or a new configuration replaces them: each waits for the other, and says
+  so ([#313](https://github.com/mindsers/configfile/issues/313)).
+- Two configfile commands started together could both take over the lock of a process that no
+  longer exists, and change files at the same time. The lock is now created with its owner's pid
+  already in it (where the filesystem supports hard links), and taken over by one process at a
+  time. A lock that cannot be read, or that holds no process number, is no longer taken over.
+- A lock that cannot be removed at the end of a command no longer hides the command's result: a
+  warning says to delete it. A lock replaced or removed by someone else while a command held it is
+  reported too.
+- When `~/.configfile` or its lock file cannot be created, written or read, the commands that take
+  the lock (`init`, `update`, `modules deploy` and `undeploy`) say that the lock cannot be taken,
+  and why, instead of reporting an unexpected error or waiting.
+- When more than one settings entry failed, `modules deploy` and `undeploy` reported "settings
+  entrys" instead of "settings entries".
+
 ## [1.0.0] - 2026-10-05
 ### Added
 - The `modules undeploy` command to remove the files configfile deployed and restore the saved
@@ -125,7 +167,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - The `run` command to run custom and saved scripts. Scripts can be write in all languages.
 - The README file to give first information on the project (installation, usage, etc.).
 
-[Unreleased]: https://github.com/mindsers/configfile/compare/1.0.0...HEAD
+[Unreleased]: https://github.com/mindsers/configfile/compare/1.1.0...HEAD
+[1.1.0]: https://github.com/mindsers/configfile/tree/1.1.0
 [1.0.0]: https://github.com/mindsers/configfile/tree/1.0.0
 [0.3.1]: https://github.com/mindsers/configfile/tree/0.3.1
 [0.3.0]: https://github.com/mindsers/configfile/tree/0.3.0

CONTRIBUTING.md

@@ -69,7 +69,7 @@ Everyone taking part in the project follows the [code of conduct](CODE_OF_CONDUC
 
 ### Do you want to contribute to the documentation?
 
-The documentation lives with the source code: the [README](README.md) for users, and this file for contributors.
+The documentation lives with the source code: the [documentation site](docs/) for users (published at [docs.configfile.sh](https://docs.configfile.sh), run it locally with `pnpm docs:dev`), and this file for contributors. Each page of the site is a Markdown file in `docs/src/content/docs/`. The README only introduces configfile and links to the site: document behavior on the site. The usage lines and option tables of the commands page are generated from the commands' definitions: after adding or changing a command, an argument or an option, run `pnpm docs:commands` (a test fails until the page is up to date). A new command first needs its section and an empty `<!-- generated: configfile <command> -->` / `<!-- /generated -->` block on the page, which the script then fills. The format of `settings.json` is also described by a JSON Schema, `docs/public/schemas/settings.json`: when configfile starts accepting or refusing something new there, update the schema and the examples of `tests/settings-schema.test.ts`, which check that both agree.
 
 * Please refer to the "Do you intend to add a new feature or change an existing one?" section.