[Epic] Tooling & code-quality: close the cross-cutting gaps (companion to Pithead #279)

[VijitSingh97]

Companion to Pithead #279 (the Pithead developer-tooling epic). This mirrors the language-agnostic parts of that effort for RigForge. RigForge needs a different — and smaller — tooling set than Pithead: it's pure shell (no Python, no JS, no Docker), so most of Pithead's stack simply doesn't apply here.

What RigForge already has — and is ahead of Pithead on

RigForge's shell tooling is already mature; in several places it's ahead of Pithead and worth back-porting there:

• shellcheck (pinned 0.11.0, checksum-verified) + shfmt (pinned 3.13.1, -i 4) via make lint ✅ — Pithead has no shfmt yet (Pithead #281).
• kcov coverage + a diff-cover patch-coverage gate (90% on changed lines) ✅ — Pithead uses a flat 80%; patch coverage is the stronger lever, worth back-porting to Pithead.
• GitHub Actions SHA-pinned (checkout@df4cb1c…) ✅ — Pithead is on mutable @v4 tags (Pithead #282 fixes that).
• Supply-chain-hardened XMRig build: pinned by version and commit, with post-clone commit verification ✅.
• Checksum-verified pinned tool installs in CI (avoids the apt-mirror flakiness Pithead hit in its tune: confirm the applied config beats the previous one on the live rig (A/B) #64) ✅.
• Real macOS CI (incl. bash 3.2 portability) + Docker/macOS e2e ✅.

What does NOT apply here (Pithead-only)

ruff / uv / ty / hypothesis (no Python) · Biome (no JS/CSS) · buf (no proto) · Trivy / Dependabot-docker (no container images). That's why RigForge's set is different rather than a copy of Pithead's.

The remaining gaps (this epic)

• tooling: supply-chain & secrets hardening (gitleaks, Dependabot, zizmor) #117 — Supply-chain & secrets — gitleaks, Dependabot (github-actions only — to maintain the SHA pins it already has), zizmor workflow audit.
• tooling: DX glue + config/docs lint (.editorconfig, pre-commit, yamllint, markdownlint + lychee) #118 — DX glue + config/docs lint — .editorconfig, pre-commit (orchestrate the existing shellcheck/shfmt + gitleaks), yamllint (3 YAML files), markdownlint + lychee (18 docs).

Principles (same as Pithead)

• Local == CI via pre-commit + the Makefile single-source-of-truth (the SHELL_FILES pattern already in place).
• Proportional — RigForge is a focused shell tool, not a polyglot stack; don't over-tool it.

Milestone: v1.1 (lockstep with Pithead's tooling track). Cross-repo tracker: Pithead #279 · roadmap Pithead #264.

[VijitSingh97]

✅ Epic complete. Both cross-cutting gaps landed on develop:

• tooling: supply-chain & secrets hardening (gitleaks, Dependabot, zizmor) #117 — Supply-chain & secrets (PR ci: supply-chain hardening (gitleaks, Dependabot, zizmor) + develop/main branch model #120): gitleaks (pinned+checksum-verified, full-history scan on push/PR + pre-commit hook), Dependabot (github-actions ecosystem only), and zizmor (pinned via pipx, online advisory audit + weekly schedule). Hardened ci.yml/release.yml to a read-only default token + persist-credentials: false so the audit is clean.
• tooling: DX glue + config/docs lint (.editorconfig, pre-commit, yamllint, markdownlint + lychee) #118 — DX glue + config/docs lint (PR ci: DX glue + config/docs lint (.editorconfig, pre-commit, yamllint, markdownlint, lychee) #122): .editorconfig, pre-commit (make lint + gitleaks + freebie hooks), yamllint + markdownlint as CI gates, and lychee link-checking on a weekly schedule. All driven through Makefile targets so pre-commit and CI share one source of truth.

Also adopted the develop/main branch model (mirrors Pithead) with branch protection on develop (9 required checks).

Nothing else tooling-wise is outstanding — RigForge is pure shell, so the Python/JS/Docker surfaces from Pithead's stack (ruff/Biome/buf/Trivy) don't apply. Closing as done; the develop→main promotion will ride the v1.1 release.