The repo is public: restore CI, and install without a key

Two things follow from opening this up, and both were written into the repo
as "private" facts that are now false.

Actions is back. It was deleted on 2026-08-29 because the job was refused
before a runner was ever allocated: an unpaid balance on the profullstack org
suspends Actions compute on private repos. As the previous commit established,
the balance is not this repo's CI minutes -- those are free -- it is artifact
storage and Code Quality credits run up elsewhere.

Nothing about that balance has been paid. It is still owed and still suspends
every private repo in the org. The suspension simply does not reach public
repos, so the one thing standing between this workflow and a runner is gone.
Removing it was right while it could not run; keeping it removed now is not.

The workflow runs bin/scripts-check rather than restating the checks in YAML,
which is what the old one did -- three loops in a script and the same three
loops in a workflow, free to drift. The pre-push hook stays: it is the copy
that runs before the push, and --no-verify now only defers the same command to
the runner instead of skipping it.

install.sh clones over HTTPS by default, so a new box needs no key and no
account:

  curl -fsSL https://raw.githubusercontent.com/profullstack/scripts/main/install.sh | sh

That also ends the chicken-and-egg this repo carried, where provision-ssh-keys
could only be fetched with the key it exists to install. --ssh (or SCRIPTS_REPO)
still gets a pushable checkout; an existing checkout keeps its own origin, so
the dev box is untouched. Verified by cloning with the credential helper
disabled and GIT_TERMINAL_PROMPT=0, and by a --dry-run resolving v0.2.1
anonymously off the remote.

README and all three file headers updated: they said there is no CI and no
anonymous install, in detail and on purpose, which would have been the most
misleading thing in the repo to a first reader.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EP9qibz6eUB3wB8sGHCVS5

Author: ralyodio

.githooks/pre-push

@@ -1,17 +1,22 @@
 #!/usr/bin/env bash
 # Run the release gate before anything leaves this machine.
 #
-# This is where the gate lives now. It was a GitHub Actions workflow until
-# 2026-08-29, when the job was refused before it ever started: an unpaid balance
-# on the profullstack org suspends Actions compute on private repos.
+# CI runs this same `bin/scripts-check` on every push and tag, so the hook is
+# not the only gate any more. It stays because it is the one that runs before
+# the push rather than after it: a syntax error caught here never reaches the
+# remote at all, and every tool in bin/ is a symlink into a working tree, so a
+# broken one is on PATH on every box at the next upgrade.
+#
+# For a while it was the only gate. The workflow was deleted on 2026-08-29,
+# when the job was refused before it ever started: an unpaid balance on the
+# profullstack org suspends Actions compute on private repos.
 #
 # Note the balance is NOT this repo's CI minutes -- those are covered by the
 # included allowance at net $0.00. It is Actions artifact storage and Code
 # Quality credits run up on unrelated repos. So deleting the workflow saved no
 # money; it was removed because a gate that cannot run is worse than no gate.
-#
-# Nothing here needs a hosted runner anyway -- no build, no matrix, no secret --
-# so a runner to execute `bash -n` was the wrong shape regardless.
+# The balance is still owed, and still suspends every private repo in the org.
+# This one is public, which is why CI could come back here and not there.
 #
 # Set up by install.sh (`git config core.hooksPath .githooks`). To run the same
 # checks by hand: `scripts-check`. To push past it in an emergency:

.github/workflows/release.yml

@@ -0,0 +1,63 @@
+# The release gate, and the release itself.
+#
+# This workflow existed before, was deleted on 2026-08-29, and is back. It was
+# never broken: profullstack is on the free plan, this repo was private, and
+# GitHub refused the job for billing before a runner was ever allocated. That
+# surfaces as a red X with no logs, which reads exactly like a broken workflow.
+# The repo is public now and Actions minutes are free on public repos, so the
+# job can actually run — which is the only thing that ever stopped it.
+#
+# The gate is `bin/scripts-check`, not a copy of it. The previous version of
+# this file inlined the same three loops in YAML, so CI and the local hook were
+# two implementations of one rule and free to drift. Here the runner runs the
+# same file `.githooks/pre-push` does; the hook stays because feedback before a
+# push beats feedback after one, not because CI is untrusted.
+#
+# What a release means here: install.sh and scripts-upgrade resolve the newest
+# `v*` tag on the remote and check the tree out at it. The TAG is the artifact.
+# There is deliberately no tarball, because nothing would ever download one.
+name: release
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  pull_request:
+
+permissions:
+  contents: write
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # scripts-check skips shellcheck with a note when it is absent, so
+      # without this step the lint third of the gate would quietly not run.
+      - name: Install shellcheck
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck
+
+      - name: scripts-check
+        run: bin/scripts-check
+
+  release:
+    needs: check
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with: { fetch-depth: 0 }
+
+      - name: Create the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          tag="${GITHUB_REF_NAME}"
+          if gh release view "$tag" >/dev/null 2>&1; then
+            echo "release $tag already exists"; exit 0
+          fi
+          gh release create "$tag" \
+            --title "$tag" \
+            --generate-notes

README.md

@@ -5,13 +5,21 @@ Hand-written command-line tools. Everything in `bin/` is meant to sit on `PATH`.
 ## Install
 
 ```sh
-git clone git@github.com:profullstack/scripts.git ~/scripts
-sh ~/scripts/install.sh
+curl -fsSL https://raw.githubusercontent.com/profullstack/scripts/main/install.sh | sh
 ```
 
-The repo is private, so there is no anonymous `curl | sh`: the clone needs a key
-GitHub already knows. On a brand-new box that has to come first, which is the one
-chicken-and-egg here, since `provision-ssh-keys` is itself in this repo.
+That is the whole thing on a brand-new box: the repo is public, so the clone
+needs no key and no account. It also ends the chicken-and-egg this repo used to
+have, where `provision-ssh-keys` — the tool that puts our keys on a machine —
+could only be fetched using the key it exists to install.
+
+Cloning by hand works the same way, and `--ssh` gets you a checkout you can push
+from:
+
+```sh
+git clone https://github.com/profullstack/scripts.git ~/scripts
+sh ~/scripts/install.sh          # or: sh ~/scripts/install.sh --ssh
+```
 
 `install.sh` clones (or updates) the checkout, moves it to the newest release
 tag, and symlinks every executable in `bin/` into `~/.local/bin`. Symlinking
@@ -21,6 +29,7 @@ rather than copying keeps `~/.local/bin` and this repo from drifting apart.
 sh install.sh                 # newest release
 sh install.sh --edge          # track main instead
 sh install.sh --ref v0.2.0    # a specific tag
+sh install.sh --ssh           # clone over SSH, for a checkout you push from
 sh install.sh --dry-run       # say what would happen, change nothing
 ```
 
@@ -43,31 +52,35 @@ and checks the tree out at it. Cutting a release is therefore exactly:
 git tag -a v0.2.0 -m "..." && git push origin v0.2.0
 ```
 
-The gate runs before the push, not after it. `.githooks/pre-push` runs
-`scripts-check`, which parses every script by shebang, verifies the executable
-bits, and runs `shellcheck -S error` over the shell ones. Then publish the
-release object:
-
-```sh
-gh release create v0.2.0 --title "v0.2.0 — ..." --notes-file notes.md
-```
-
-**There is no CI, on purpose.** This was a GitHub Actions workflow until
-2026-08-29, when the job was refused before it ever ran: an unpaid balance on
-the `profullstack` org suspends Actions compute on private repos. It failed as a
-red X with no logs, which reads exactly like a broken workflow and is not one,
-and a gate that does not run is worse than no gate, because the X implies
-something was checked.
-
-Worth being precise about the money, because it is easy to assume wrongly: **this
+Pushing the tag is enough. `.github/workflows/release.yml` runs the gate and
+then creates the release object, so `gh release create` by hand is only a
+fallback for when Actions is unavailable.
+
+**The gate runs twice, and that is deliberate.** `bin/scripts-check` is the
+rule — it parses every script by shebang, verifies the executable bits, and runs
+`shellcheck -S error` over the shell ones. `.githooks/pre-push` runs it before
+anything leaves the machine, and CI runs *that same file* on the runner. Neither
+is a re-implementation of the other, which is how the two used to be free to
+drift; the hook stays because feedback before a push beats feedback after one.
+
+**A note on the red X in the history, and why CI came back.** This workflow was
+deleted on 2026-08-29 and restored when the repo was opened up. It was never
+broken YAML: an unpaid balance on the `profullstack` org suspends Actions
+compute, and the job was refused before a runner was ever allocated — a red X
+with no logs, which is indistinguishable from a workflow that ran and failed. A
+gate that cannot run is worse than no gate, because the X implies something was
+checked, so it was removed rather than left there lying.
+
+Be precise about the money, because the obvious assumption is wrong: **this
 repo's CI minutes were never the cost.** They are covered by the included
 allowance at net $0.00. The balance is Actions artifact storage and Code Quality
-credits accrued on unrelated repositories. Deleting this workflow therefore saved
-nothing on the bill, and clearing that balance would let Actions run again
-everywhere.
+credits accrued on unrelated repositories, so deleting this workflow saved
+nothing on the bill and was never going to.
 
-It stays deleted regardless, because nothing here needs a hosted runner: no
-build, no matrix, no secret, just three loops over files already on disk.
+What changed is not the balance — it is still owed, and every *private* repo in
+the org is still suspended by it. The suspension only applies to private repos.
+This one is public now, so the single thing standing between this workflow and a
+runner is gone.
 
 **A development checkout is left alone.** Because `~/.local/bin/*` are symlinks
 into the working tree, the command on PATH is whatever the checkout is at, so
@@ -243,7 +256,8 @@ scripts-check --quiet   # only complain
 ```
 
 `.githooks/pre-push` runs it before every push, wired up by `install.sh` via
-`git config core.hooksPath .githooks`. `git push --no-verify` bypasses it.
+`git config core.hooksPath .githooks`. `git push --no-verify` bypasses it — and
+CI then runs the same command on the runner, which does not.
 
 A missing `shellcheck` is skipped with a note rather than failing — an absent
 linter must not be able to block a release.

bin/scripts-check

@@ -4,20 +4,28 @@
 #   scripts-check          # check the checkout this command lives in
 #   scripts-check --quiet  # only complain
 #
-# This used to be a GitHub Actions workflow. It is not any more: an unpaid
-# balance on the profullstack org suspends Actions compute on private repos, so
-# the job was refused before it ever ran -- a red X with no logs, which reads
-# exactly like a broken workflow and is not one. A gate that does not run is
-# worse than no gate, because the red X implies something was checked.
+# This file is the rule, and everything else calls it. `.githooks/pre-push`
+# runs it before anything leaves the machine, and .github/workflows/release.yml
+# runs this same file on the runner rather than re-stating the checks in YAML —
+# which is what the two used to do, leaving CI and the hook free to drift.
+#
+# For a while there was no CI half at all. The workflow was deleted on
+# 2026-08-29, while the repo was private: an unpaid balance on the profullstack
+# org suspends Actions compute on private repos, so the job was refused before
+# it ever ran -- a red X with no logs, which reads exactly like a broken
+# workflow and is not one. A gate that does not run is worse than no gate,
+# because the red X implies something was checked.
 #
 # To be accurate about the money: this repo's CI minutes were never the cost.
 # They are covered by the included allowance at net $0.00. The balance is
-# Actions artifact storage and Code Quality credits on unrelated repos. Moving
-# the gate here saved nothing on the bill and was not meant to.
+# Actions artifact storage and Code Quality credits on unrelated repos, so
+# moving the gate here saved nothing on the bill and was not meant to. The
+# balance is still owed; the suspension just does not reach public repos, which
+# is why opening this one up brought CI back.
 #
-# So it runs here instead, and `.githooks/pre-push` runs it before every push.
-# Nothing about it needed a hosted runner: there is no build, no matrix, and
-# no secret. It is three loops over files that are already on disk.
+# Nothing here ever needed a hosted runner: no build, no matrix, no secret. It
+# is three loops over files that are already on disk, which is exactly why the
+# same three loops can run in both places at no cost.
 #
 # What it checks, and why each one:
 #

install.sh

@@ -4,26 +4,33 @@
 #   sh install.sh                 # latest release tag
 #   sh install.sh --edge          # track main instead
 #   sh install.sh --ref v0.2.0    # a specific tag or branch
+#   sh install.sh --ssh           # clone over SSH, for a checkout you push from
 #   sh install.sh --dry-run       # say what would happen, change nothing
 #
-# The repo is private, so there is no anonymous curl one-liner: this clones
-# over SSH and relies on the key that is already on the box. On a fresh
-# machine that means provisioning a key first — bin/provision-ssh-keys is the
-# tool for that, which is a chicken-and-egg only the very first time.
+# The repo is public, so a fresh box needs no key and no account:
 #
-#   ssh -T git@github.com          # must not say "Permission denied"
-#   git clone git@github.com:profullstack/scripts.git ~/scripts
-#   sh ~/scripts/install.sh
+#   curl -fsSL https://raw.githubusercontent.com/profullstack/scripts/main/install.sh | sh
+#
+# That is the whole install. Cloning over HTTPS also ends the chicken-and-egg
+# this file used to carry: provision-ssh-keys lives in this repo, so getting it
+# onto a new machine used to need the very key it exists to install.
+#
+# Use --ssh (or SCRIPTS_REPO) for a checkout you intend to push from. An HTTPS
+# clone reads fine and upgrades fine; it is just not set up to write.
 #
 # POSIX sh on purpose. This is the one file that runs before anything is
 # installed, possibly on a box whose only shell is dash, so it may not assume
 # bash the way the tools in bin/ do.
 #
-# There is no CI. The gate that used to be a GitHub Actions workflow is now
-# bin/scripts-check, run by .githooks/pre-push, because an unpaid balance on the
-# org suspends Actions compute on private repos and the job was refused before
-# it started. Not this repo's minutes, which are free -- storage and Code
-# Quality credits elsewhere. This script wires the hook up.
+# THE GATE RUNS TWICE, ON PURPOSE. bin/scripts-check is the rule. This script
+# points core.hooksPath at .githooks so it runs before every push, and
+# .github/workflows/release.yml runs that same file on the runner.
+#
+# CI is back because the repo is public. An unpaid balance on the org suspends
+# Actions compute on PRIVATE repos -- not this repo's minutes, which are free;
+# storage and Code Quality credits elsewhere -- and while this repo was private
+# the job was refused before it ever started. The balance is still owed; public
+# repos are simply not subject to it.
 #
 # WHY A TAG BY DEFAULT. Because `~/.local/bin/*` are symlinks into the working
 # tree, the command on PATH is whatever the checkout happens to be at. Tracking
@@ -34,7 +41,12 @@
 
 set -eu
 
+# HTTPS by default: the repo is public, so this works with no key, no account
+# and no prior setup, which is the whole point of the curl one-liner above.
+# SSH stays a flag away for the boxes that push.
+REPO_HTTPS="https://github.com/profullstack/scripts.git"
 REPO_SSH="git@github.com:profullstack/scripts.git"
+REPO="${SCRIPTS_REPO:-$REPO_HTTPS}"
 DIR="${SCRIPTS_DIR:-$HOME/scripts}"
 BINDIR="${SCRIPTS_BIN:-$HOME/.local/bin}"
 REF="${SCRIPTS_REF:-}"
@@ -43,12 +55,14 @@ DRY=0
 while [ $# -gt 0 ]; do
   case "$1" in
     --edge)     REF=main ;;
+    --ssh)      REPO="$REPO_SSH" ;;
+    --https)    REPO="$REPO_HTTPS" ;;
     --ref)      REF="${2:?--ref needs a tag or branch}"; shift ;;
     --ref=*)    REF="${1#--ref=}" ;;
     --dir)      DIR="${2:?--dir needs a path}"; shift ;;
     --bin)      BINDIR="${2:?--bin needs a path}"; shift ;;
     --dry-run|-n) DRY=1 ;;
-    -h|--help)  sed -n '2,27p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+    -h|--help)  sed -n '2,19p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
     *)          echo "install.sh: unknown option $1" >&2; exit 2 ;;
   esac
   shift
@@ -61,7 +75,7 @@ die()  { echo "install.sh: $*" >&2; exit 1; }
 # The newest v-tag on the remote, by version sort. Read from the remote rather
 # than a local tag list so a stale checkout cannot report an old "latest".
 latest_tag() {
-  git ls-remote --tags --refs "$REPO_SSH" 'v*' 2>/dev/null \
+  git ls-remote --tags --refs "$REPO" 'v*' 2>/dev/null \
     | awk '{print $2}' | sed 's#refs/tags/##' \
     | sort -V | tail -1
 }
@@ -71,8 +85,8 @@ latest_tag() {
 if [ ! -d "$DIR/.git" ]; then
   [ -e "$DIR" ] && die "$DIR exists but is not a git checkout; move it aside"
   if [ -z "$REF" ]; then REF="$(latest_tag)"; [ -n "$REF" ] || REF=main; fi
-  say "cloning $REPO_SSH -> $DIR at $REF"
-  run git clone --quiet "$REPO_SSH" "$DIR"
+  say "cloning $REPO -> $DIR at $REF"
+  run git clone --quiet "$REPO" "$DIR"
   [ "$DRY" = 1 ] || git -C "$DIR" -c advice.detachedHead=false checkout --quiet "$REF"
 else
   say "checkout exists at $DIR"