feat!: improve curl safety, non-apt warnings, and add outputs

.github/actionlint.yaml

@@ -0,0 +1,10 @@
+paths:
+  .github/workflows/*.yml:
+    ignore:
+      # actionlint v1.7.12 ships stale metadata for create-github-app-token@v3:
+      # it still marks `app-id` as required and doesn't know about `client-id`.
+      # Upstream action.yml accepts both (only `private-key` is required) and
+      # deprecates `app-id`. Remove once actionlint refreshes the v3 snapshot.
+      - 'missing input "app-id" which is required by action "actions/create-github-app-token@v3"'
+      - 'input "client-id" is not defined in action "actions/create-github-app-token@v3"'
+      - 'property "job_workflow_ref" is not defined in object type'

.github/workflows/ci.yml

@@ -0,0 +1,18 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  lint:
+    name: Lint & Verify Action
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v6
+
+      - name: Run pre-commit
+        uses: pre-commit/action@v3.0.1

.pre-commit-config.yaml

@@ -0,0 +1,25 @@
+# commit-msg is needed for conventional-pre-commit; pre-commit install
+# reads this so both stages get hooked.
+default_install_hook_types: [pre-commit, commit-msg]
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-merge-conflict
+      - id: check-added-large-files
+
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.12
+    hooks:
+      - id: actionlint
+
+  - repo: https://github.com/compilerla/conventional-pre-commit
+    rev: v4.4.0
+    hooks:
+      - id: conventional-pre-commit
+        stages: [commit-msg]
+        args: [feat, fix, docs, style, refactor, test, chore, ci]

Makefile

@@ -0,0 +1,20 @@
+.DEFAULT_GOAL := help
+
+.PHONY: setup lint help
+
+##@ Bootstrap
+
+setup: ## Install the pre-commit git hooks
+	uvx pre-commit install
+
+##@ Quality
+
+lint: ## Run all pre-commit checks (actionlint, yaml, formatting)
+	uvx pre-commit run --all-files
+
+##@ Utilities
+
+help: ## Show this help
+	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} \
+	  /^[a-zA-Z0-9_/-]+:.*?##/ { printf "  \033[36m%-20s\033[0m %s\n", $$1, $$2 } \
+	  /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) }' $(MAKEFILE_LIST)

action.yml

@@ -1,5 +1,15 @@
 name: "AetherPak Setup CLI"
 description: "Download AetherPak CLI binary and install dependencies on Linux."
+branding:
+  icon: "terminal"
+  color: "blue"
+outputs:
+  version:
+    description: "Resolved version tag of AetherPak CLI"
+    value: ${{ steps.download.outputs.version }}
+  path:
+    description: "Directory where the AetherPak CLI binary is installed"
+    value: ${{ steps.download.outputs.path }}
 inputs:
   version:
     description: "Version of AetherPak CLI to install (e.g., v0.2.0, latest)"
@@ -35,12 +45,17 @@ runs:
         command -v ostree  >/dev/null 2>&1 || MISSING="$MISSING ostree"
         command -v gpg     >/dev/null 2>&1 || MISSING="$MISSING gnupg"
         command -v flatpak-builder >/dev/null 2>&1 || MISSING="$MISSING flatpak-builder"
-        if [ -n "$MISSING" ] && command -v apt-get >/dev/null 2>&1; then
-          export DEBIAN_FRONTEND=noninteractive
-          sudo apt-get update && sudo apt-get install -y $MISSING
+        if [ -n "$MISSING" ]; then
+          if command -v apt-get >/dev/null 2>&1; then
+            export DEBIAN_FRONTEND=noninteractive
+            sudo apt-get update && sudo apt-get install -y $MISSING
+          else
+            echo "::warning::Missing dependencies ($MISSING) could not be installed because 'apt-get' is not available. Please install them manually."
+          fi
         fi
 
     - name: Download AetherPak CLI
+      id: download
       shell: bash
       env:
         GH_TOKEN: ${{ github.token }}
@@ -69,11 +84,11 @@ runs:
           fi
           # Fallback to public GitHub API
           if [ -z "$TAG" ]; then
-            AUTH_HEADER=""
+            AUTH=()
             if [ -n "${GH_TOKEN:-}" ]; then
-              AUTH_HEADER="-H \"Authorization: token $GH_TOKEN\""
+              AUTH=(-H "Authorization: token $GH_TOKEN")
             fi
-            TAG=$(eval "curl -sSL $AUTH_HEADER https://api.github.com/repos/${{ inputs.repo }}/releases/latest" | jq -r '.tag_name // empty')
+            TAG=$(curl -sSL "${AUTH[@]}" "https://api.github.com/repos/${{ inputs.repo }}/releases/latest" | jq -r '.tag_name // empty' || true)
           fi
           # Fail if we still couldn't resolve the latest tag
           if [ -z "$TAG" ] || [ "$TAG" = "null" ]; then
@@ -103,12 +118,12 @@ runs:
         fi
 
         if [ "$DOWNLOADED" = "false" ]; then
-          AUTH_HEADER=""
+          AUTH=()
           if [ -n "${GH_TOKEN:-}" ]; then
-            AUTH_HEADER="-H \"Authorization: token $GH_TOKEN\""
+            AUTH=(-H "Authorization: token $GH_TOKEN")
           fi
           URL="https://github.com/${{ inputs.repo }}/releases/download/${TAG}/${ARCHIVE_NAME}"
-          eval "curl -fL $AUTH_HEADER -o \"$DOWNLOAD_DIR/$ARCHIVE_NAME\" \"$URL\""
+          curl -fL "${AUTH[@]}" -o "$DOWNLOAD_DIR/$ARCHIVE_NAME" "$URL"
         fi
 
         # 4. Extract archive
@@ -121,3 +136,7 @@ runs:
         # 6. Add to PATH
         echo "$INSTALL_DIR" >> "$GITHUB_PATH"
         echo "Successfully installed aetherpak $TAG to $INSTALL_DIR and added to GITHUB_PATH"
+
+        # 7. Set outputs
+        echo "version=$TAG" >> "$GITHUB_OUTPUT"
+        echo "path=$INSTALL_DIR" >> "$GITHUB_OUTPUT"