ci: lint shell, workflows, TOML, Nix, and justfiles via nix devShell

.editorconfig

@@ -23,3 +23,19 @@ indent_size = 2
 [**.nix]
 indent_style = space
 indent_size = 2
+
+# shfmt reads these natively. Match existing script style to keep
+# the format pass minimal.
+[*.sh]
+indent_style = space
+indent_size = 4
+switch_case_indent = true
+
+[demo/throttle/enable]
+indent_style = space
+indent_size = 4
+switch_case_indent = true
+
+# Skip vendored / build output trees when shfmt walks the repo.
+[{node_modules,target,dist,.venv}/**]
+ignore = true

.github/justfile

@@ -0,0 +1,9 @@
+set fallback
+
+# Lint GitHub Actions workflows. Silently skipped if actionlint is not installed.
+check:
+    @if command -v actionlint >/dev/null 2>&1; then actionlint; fi
+
+# CI variant: actionlint is required (provided by the nix devShell).
+ci:
+    actionlint

.github/scripts/release.sh

@@ -21,7 +21,7 @@ parse_version() {
 
     if [[ "$ref" =~ ^${prefix}-v([0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?)$ ]]; then
         local version="${BASH_REMATCH[1]}"
-        echo "version=${version}" >> "$GITHUB_OUTPUT"
+        echo "version=${version}" >>"$GITHUB_OUTPUT"
         echo "Parsed version: ${version}"
     else
         echo "Tag format not recognized: $ref (expected ${prefix}-v<semver>)" >&2
@@ -36,10 +36,10 @@ prev_tag() {
     local current_tag="${GITHUB_REF#refs/tags/}"
 
     local prev
-    prev=$(git tag --list "${prefix}-v*" --sort=v:refname \
-        | awk -v cur="$current_tag" '$0 == cur { print prev; found=1; exit } { prev=$0 } END { if (!found) print "" }')
+    prev=$(git tag --list "${prefix}-v*" --sort=v:refname |
+        awk -v cur="$current_tag" '$0 == cur { print prev; found=1; exit } { prev=$0 } END { if (!found) print "" }')
 
-    echo "tag=${prev}" >> "$GITHUB_OUTPUT"
+    echo "tag=${prev}" >>"$GITHUB_OUTPUT"
     echo "Previous tag: ${prev:-none}"
 }
 
@@ -52,7 +52,7 @@ create_release() {
     local title="${RELEASE_TITLE:?RELEASE_TITLE must be set}"
     local prev_tag="${RELEASE_PREV_TAG:-}"
 
-    if gh release view "$tag" > /dev/null 2>&1; then
+    if gh release view "$tag" >/dev/null 2>&1; then
         echo "Release exists, updating assets and metadata..."
         gh release upload "$tag" "$artifacts_dir"/* --clobber
         if [ -n "$prev_tag" ]; then
@@ -80,8 +80,8 @@ create_release() {
 # Dispatch subcommands
 case "${1:-}" in
     parse-version) parse_version "$2" ;;
-    prev-tag)      prev_tag "$2" ;;
-    create)        create_release "$2" ;;
+    prev-tag) prev_tag "$2" ;;
+    create) create_release "$2" ;;
     *)
         echo "Usage: $0 {parse-version|prev-tag|create} <args>" >&2
         exit 1

.github/scripts/render-formula.sh

@@ -27,21 +27,21 @@ OUTPUT=""
 
 while [[ $# -gt 0 ]]; do
     case $1 in
-        --template|--version|--release-dir|--crate|--output)
+        --template | --version | --release-dir | --crate | --output)
             if [[ $# -lt 2 ]]; then
                 echo "Error: $1 requires a value" >&2
                 exit 1
             fi
             case $1 in
-                --template)    TEMPLATE="$2" ;;
-                --version)     VERSION="$2" ;;
+                --template) TEMPLATE="$2" ;;
+                --version) VERSION="$2" ;;
                 --release-dir) RELEASE_DIR="$2" ;;
-                --crate)       CRATE="$2" ;;
-                --output)      OUTPUT="$2" ;;
+                --crate) CRATE="$2" ;;
+                --output) OUTPUT="$2" ;;
             esac
             shift 2
             ;;
-        -h|--help)
+        -h | --help)
             echo "Usage: $0 --template T --version V --release-dir D --crate C --output O"
             exit 0
             ;;
@@ -98,5 +98,5 @@ if grep -q '__[A-Z0-9_]\+__' <<<"$rendered"; then
 fi
 
 mkdir -p "$(dirname "$OUTPUT")"
-printf '%s\n' "$rendered" > "$OUTPUT"
+printf '%s\n' "$rendered" >"$OUTPUT"
 echo "Wrote: $OUTPUT"

.github/workflows/docker.yml

@@ -23,8 +23,8 @@ jobs:
         run: |
           ref=${GITHUB_REF#refs/tags/}
           if [[ "$ref" =~ ^([a-z-]+)-v([0-9.]+)$ ]]; then
-            echo "target=${BASH_REMATCH[1]}" >> $GITHUB_OUTPUT
-            echo "version=${BASH_REMATCH[2]}" >> $GITHUB_OUTPUT
+            echo "target=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT"
+            echo "version=${BASH_REMATCH[2]}" >> "$GITHUB_OUTPUT"
           else
             echo "Tag format not recognized." >&2
             exit 1
@@ -101,6 +101,7 @@ jobs:
       - name: Create manifest
         working-directory: /tmp/digests
         run: |
+          # shellcheck disable=SC2046  # intentional word-splitting: one arg per digest
           docker buildx imagetools create \
             -t ${{ env.REGISTRY }}/${{ needs.parse.outputs.target }}:${{ needs.parse.outputs.version }} \
             -t ${{ env.REGISTRY }}/${{ needs.parse.outputs.target }}:latest \

.github/workflows/moq-cli.yml

@@ -115,6 +115,7 @@ jobs:
         run: |
           # nfpm doesn't expand ${VAR} in contents[].src or templating
           # there either, so render the env vars in ourselves.
+          # shellcheck disable=SC2016  # envsubst varlist must be single-quoted
           envsubst '$VERSION $ARCH $BINARY_PATH' \
             < packaging/moq-cli/nfpm.yaml > /tmp/nfpm.yaml
           nfpm pkg --packager deb --config /tmp/nfpm.yaml --target dist/
@@ -126,6 +127,7 @@ jobs:
           ARCH: ${{ matrix.rpm-arch }}
           BINARY_PATH: target/${{ matrix.target }}/release/moq
         run: |
+          # shellcheck disable=SC2016  # envsubst varlist must be single-quoted
           envsubst '$VERSION $ARCH $BINARY_PATH' \
             < packaging/moq-cli/nfpm.yaml > /tmp/nfpm.yaml
           nfpm pkg --packager rpm --config /tmp/nfpm.yaml --target dist/

.github/workflows/moq-gst.yml

@@ -119,6 +119,7 @@ jobs:
           PLUGIN_DIR: /usr/lib/${{ matrix.deb-multiarch }}/gstreamer-1.0
         run: |
           mkdir -p dist
+          # shellcheck disable=SC2016  # envsubst varlist must be single-quoted
           envsubst '$VERSION $ARCH $PKG_NAME $PLUGIN_PATH $PLUGIN_DIR' \
             < packaging/moq-gst/nfpm.yaml > /tmp/nfpm.yaml
           nfpm pkg --packager deb --config /tmp/nfpm.yaml --target dist/
@@ -133,6 +134,7 @@ jobs:
           PLUGIN_DIR: /usr/lib64/gstreamer-1.0
         run: |
           mkdir -p dist
+          # shellcheck disable=SC2016  # envsubst varlist must be single-quoted
           envsubst '$VERSION $ARCH $PKG_NAME $PLUGIN_PATH $PLUGIN_DIR' \
             < packaging/moq-gst/nfpm.yaml > /tmp/nfpm.yaml
           nfpm pkg --packager rpm --config /tmp/nfpm.yaml --target dist/

.github/workflows/moq-relay.yml

@@ -104,6 +104,7 @@ jobs:
           ARCH: ${{ matrix.deb-arch }}
           BINARY_PATH: target/${{ matrix.target }}/release/moq-relay
         run: |
+          # shellcheck disable=SC2016  # envsubst varlist must be single-quoted
           envsubst '$VERSION $ARCH $BINARY_PATH' \
             < packaging/moq-relay/nfpm.yaml > /tmp/nfpm.yaml
           nfpm pkg --packager deb --config /tmp/nfpm.yaml --target dist/
@@ -115,6 +116,7 @@ jobs:
           ARCH: ${{ matrix.rpm-arch }}
           BINARY_PATH: target/${{ matrix.target }}/release/moq-relay
         run: |
+          # shellcheck disable=SC2016  # envsubst varlist must be single-quoted
           envsubst '$VERSION $ARCH $BINARY_PATH' \
             < packaging/moq-relay/nfpm.yaml > /tmp/nfpm.yaml
           nfpm pkg --packager rpm --config /tmp/nfpm.yaml --target dist/

.github/workflows/moq-token-cli.yml

@@ -101,6 +101,7 @@ jobs:
           ARCH: ${{ matrix.deb-arch }}
           BINARY_PATH: target/${{ matrix.target }}/release/moq-token-cli
         run: |
+          # shellcheck disable=SC2016  # envsubst varlist must be single-quoted
           envsubst '$VERSION $ARCH $BINARY_PATH' \
             < packaging/moq-token-cli/nfpm.yaml > /tmp/nfpm.yaml
           nfpm pkg --packager deb --config /tmp/nfpm.yaml --target dist/
@@ -112,6 +113,7 @@ jobs:
           ARCH: ${{ matrix.rpm-arch }}
           BINARY_PATH: target/${{ matrix.target }}/release/moq-token-cli
         run: |
+          # shellcheck disable=SC2016  # envsubst varlist must be single-quoted
           envsubst '$VERSION $ARCH $BINARY_PATH' \
             < packaging/moq-token-cli/nfpm.yaml > /tmp/nfpm.yaml
           nfpm pkg --packager rpm --config /tmp/nfpm.yaml --target dist/

.github/workflows/release-brew.yml

@@ -115,9 +115,11 @@ jobs:
           fi
           crate="${BASH_REMATCH[1]}"
           version="${BASH_REMATCH[2]}"
-          echo "crate=$crate" >> "$GITHUB_OUTPUT"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          {
+            echo "crate=$crate"
+            echo "version=$version"
+            echo "tag=$TAG"
+          } >> "$GITHUB_OUTPUT"
           echo "Crate: $crate"
           echo "Version: $version"
 

.taplo.toml

@@ -0,0 +1,9 @@
+# Skip vendored / build trees so `taplo format` doesn't recurse into them.
+exclude = ["**/node_modules/**", "**/target/**", "**/dist/**", "**/.venv/**"]
+
+# Match the existing repo style (4-space indent on Cargo.toml, lines up
+# to ~120 chars) so the initial format pass stays minimal.
+[formatting]
+indent_string = "    "
+column_width = 150
+align_comments = false

demo/boy/justfile

@@ -2,84 +2,85 @@ set fallback
 
 # Run the GB demo: relay + emulator publisher + web viewer.
 default:
-	bun install
+    bun install
 
-	bun run concurrently --kill-others --prefix-colors auto \
-		"just relay" \
-		"just wait && just b2s" \
-		"just wait && just dangan" \
-		"just wait && just web"
+    bun run concurrently --kill-others --prefix-colors auto \
+    	"just relay" \
+    	"just wait && just b2s" \
+    	"just wait && just dangan" \
+    	"just wait && just web"
 
 # Download the given ROM from our R2 bucket.
 download rom:
-	#!/usr/bin/env bash
-	if [ ! -f "rom/{{rom}}" ]; then
-		mkdir -p rom
-		curl -fSL -o "rom/{{rom}}.tmp" "https://rom.moq.dev/{{rom}}"
-		mv "rom/{{rom}}.tmp" "rom/{{rom}}"
-	fi
+    #!/usr/bin/env bash
+    if [ ! -f "rom/{{ rom }}" ]; then
+    	mkdir -p rom
+    	curl -fSL -o "rom/{{ rom }}.tmp" "https://rom.moq.dev/{{ rom }}"
+    	mv "rom/{{ rom }}.tmp" "rom/{{ rom }}"
+    fi
 
 # Big2Small (puzzle): https://mdsteele.itch.io/big2small
 b2s:
-	just download big2small.gb
-	just start rom/big2small.gb
+    just download big2small.gb
+    just start rom/big2small.gb
 
 # Dangan GB2 (bullet hell): https://snorpung.itch.io/dangan-gb2
 dangan:
-	just download DanganGB2.gbc
-	just start rom/DanganGB2.gbc
+    just download DanganGB2.gbc
+    just start rom/DanganGB2.gbc
 
 # Opossum Country (horror): https://benjelter.itch.io/opossum-country
 opossum:
-	just download OpossumCountry.gbc
-	just start rom/OpossumCountry.gbc
+    just download OpossumCountry.gbc
+    just start rom/OpossumCountry.gbc
 
 # Swordbird Song - Iron Owl Tower
 songbird:
-	just download Swordbird.gb
-	just start rom/Swordbird.gb
+    just download Swordbird.gb
+    just start rom/Swordbird.gb
 
 # RunieStory
 runiestory:
-	just download RunieStory.gb
-	just start rom/RunieStory.gb
+    just download RunieStory.gb
+    just start rom/RunieStory.gb
 
 # GB Run (racing): https://biscuitlocker.itch.io/gb-run
 gb-run:
-	just download gb-run.gbc
-	just start rom/gb-run.gbc
+    just download gb-run.gbc
+    just start rom/gb-run.gbc
 
 # Start a Game Boy emulator publisher.
 start rom url='http://localhost:4443/anon':
-	cargo run --bin moq-boy -- --url "{{url}}" --rom "{{rom}}" --location localhost
+    cargo run --bin moq-boy -- --url "{{ url }}" --rom "{{ rom }}" --location localhost
 
 # Host the web server
 web url='http://localhost:4443/anon':
-	VITE_RELAY_URL="{{url}}" bun --bun vite --open
+    VITE_RELAY_URL="{{ url }}" bun --bun vite --open
 
 # --- rom.moq.dev (R2 hosting) ---
 
 # Deploy the rom.moq.dev worker
 deploy:
-	bun install
-	bun wrangler deploy
+    bun install
+    bun wrangler deploy
 
 # Upload a single ROM to R2
 upload file:
-	bun install
-	bun wrangler r2 object put "rom-moq-dev/{{file}}" --file "rom/{{file}}" --remote
+    bun install
+    bun wrangler r2 object put "rom-moq-dev/{{ file }}" --file "rom/{{ file }}" --remote
 
 # Sync all ROMs to R2
 sync dir="rom":
-	#!/usr/bin/env bash
-	set -euo pipefail
-	for file in "{{dir}}"/*; do
-		key=$(basename "$file")
-		echo "Uploading $key..."
-		bun wrangler r2 object put "rom-moq-dev/$key" --file "$file" --remote
-	done
+    #!/usr/bin/env bash
+    set -euo pipefail
+    for file in "{{ dir }}"/*; do
+    	[ -e "$file" ] || continue
+    	key=$(basename "$file")
+    	echo "Uploading $key..."
+    	bun wrangler r2 object put "rom-moq-dev/$key" --file "$file" --remote
+    done
 
 # List files in the R2 bucket
 list:
-	bun install
-	bun wrangler r2 object list "rom-moq-dev"
+    bun install
+    bun wrangler r2 object list "rom-moq-dev"

demo/justfile

@@ -8,23 +8,23 @@ mod web
 
 # Run the web demo (default).
 default:
-	bun install
-	bun run concurrently --kill-others --names srv,bbb,web --prefix-colors auto \
-		"just relay" \
-		"just wait && just pub bbb" \
-		"just wait && just web"
+    bun install
+    bun run concurrently --kill-others --names srv,bbb,web --prefix-colors auto \
+    	"just relay" \
+    	"just wait && just pub bbb" \
+    	"just wait && just web"
 
 # Wait for the localhost relay to be ready by repeatedly requesting the cert
 [private]
 wait url="http://localhost:4443/certificate.sha256":
-	#!/usr/bin/env bash
-	set -euo pipefail
-	for i in $(seq 1 600); do
-		curl -sf "{{url}}" > /dev/null 2>&1 && exit 0
-		sleep 1
-	done
-	exit 1
+    #!/usr/bin/env bash
+    set -euo pipefail
+    for i in $(seq 1 600); do
+    	curl -sf "{{ url }}" > /dev/null 2>&1 && exit 0
+    	sleep 1
+    done
+    exit 1
 
 # Throttle UDP traffic for testing (macOS only, requires sudo).
 throttle:
-	throttle/enable
+    throttle/enable