Fix dotfiles branch resolution and disk space calculation (#25)

* fix(ci): resolve dotfiles default branch via remote and silence Linux gosec

resolveBranch fell back to "main" whenever local origin/HEAD wasn't a
symbolic ref (e.g. cloned from an empty bare), causing
TestClone_DetachedHeadFallback and any user with a master-default repo
to fail with "ambiguous argument 'origin/main'". Add a final fallback
that consults the remote via `git ls-remote --symref origin HEAD`.

Also annotate the syscall.Statfs block-size conversion in
brew.CheckDiskSpace so `golangci-lint run` is clean on Linux too
(stat.Bsize is int64 on linux, uint32 on darwin — value is always
non-negative).

* ci: bump golangci-lint-action to v7 and migrate labeler config to v5

- golangci/golangci-lint-action@v6 only supports golangci-lint v1; with the
  recent bump to v2.11.4 it errors out at startup. Bump the action to v7,
  which is the v2-compatible release.
- actions/labeler@v5 requires the new `changed-files` schema. The current
  config uses the v4 flat-glob form, so every PR fails labeling with
  "found unexpected type for label 'catalog'". Convert each entry to the
  v5 `changed-files: any-glob-to-any-file` form.

* ci(lint): move dir exclusions out of run.exclude-dirs (rejected by v2.11.4)

golangci-lint v2.11.4 enforces a stricter schema than 2.5 and rejects the
deprecated `run.exclude-dirs` key with "additional properties 'exclude-dirs'
not allowed". Move the directory list to `linters.exclusions.paths` (the
v2 location) and drop the now-redundant per-path testutil rule.

* fix(snapshot): CaptureNpm returns []string{} instead of nil when no globals

When npm is installed but `npm list -g --depth=0 --parseable` returns
only the prefix line (or only npm/corepack), the loop never appends and
`var packages []string` stays nil. TestCaptureNpm_NoPanic asserts the
returned slice is not nil, so the test fails on macOS-CI runners where
npm is present but has no user-installed globals. Initialise as an empty
slice to match the early-return contract.

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: fullstackjam

.github/labeler.yml

@@ -1,24 +1,40 @@
 catalog:
-  - internal/config/data/packages.yaml
+  - changed-files:
+      - any-glob-to-any-file:
+          - internal/config/data/packages.yaml
 
 brew:
-  - internal/brew/**
+  - changed-files:
+      - any-glob-to-any-file:
+          - internal/brew/**
 
 installer:
-  - internal/installer/**
+  - changed-files:
+      - any-glob-to-any-file:
+          - internal/installer/**
 
 ci:
-  - .github/workflows/**
+  - changed-files:
+      - any-glob-to-any-file:
+          - .github/workflows/**
 
 docs:
-  - "*.md"
-  - docs/**
+  - changed-files:
+      - any-glob-to-any-file:
+          - "*.md"
+          - docs/**
 
 tests:
-  - "**/*_test.go"
+  - changed-files:
+      - any-glob-to-any-file:
+          - "**/*_test.go"
 
 snapshot:
-  - internal/snapshot/**
+  - changed-files:
+      - any-glob-to-any-file:
+          - internal/snapshot/**
 
 ui:
-  - internal/ui/**
+  - changed-files:
+      - any-glob-to-any-file:
+          - internal/ui/**

.github/workflows/test.yml

@@ -29,7 +29,7 @@ jobs:
         with:
           go-version-file: "go.mod"
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v7
         with:
           version: v2.11.4
 

.golangci.yml

@@ -2,9 +2,6 @@ version: "2"
 
 run:
   timeout: 5m
-  exclude-dirs:
-    - vendor
-    - testutil
 
 formatters:
   enable:
@@ -46,13 +43,11 @@ linters:
       excludes:
         - G304 # File path provided as taint input — acceptable for CLI tools
   exclusions:
+    paths:
+      - vendor
+      - testutil
     rules:
       - path: "_test\\.go"
         linters:
           - errcheck
           - gosec
-      - path: "testutil/"
-        linters:
-          - gosec
-          - errcheck
-          - unused

internal/brew/brew.go

@@ -289,7 +289,9 @@ func CheckDiskSpace() (float64, error) {
 	if err := syscall.Statfs(home, &stat); err != nil {
 		return 0, err
 	}
-	availableGB := float64(stat.Bavail*uint64(stat.Bsize)) / (1024 * 1024 * 1024)
+	// stat.Bsize is uint32 on darwin and int64 on linux; the kernel always
+	// reports a non-negative block size so the conversion is safe.
+	availableGB := float64(stat.Bavail*uint64(stat.Bsize)) / (1024 * 1024 * 1024) //nolint:gosec // see comment above
 	return availableGB, nil
 }
 

internal/dotfiles/dotfiles.go

@@ -159,6 +159,19 @@ func resolveBranch(dotfilesPath string) string {
 			branch = strings.TrimPrefix(ref, "refs/remotes/origin/")
 		}
 	}
+	// origin/HEAD may not be configured locally — ask the remote what its default branch is.
+	if branch == "" || branch == "HEAD" {
+		if out, err := gitOutputFunc([]string{"-C", dotfilesPath, "ls-remote", "--symref", "origin", "HEAD"}); err == nil {
+			for _, line := range strings.Split(string(out), "\n") {
+				if rest, ok := strings.CutPrefix(line, "ref: "); ok {
+					if fields := strings.Fields(rest); len(fields) >= 1 {
+						branch = strings.TrimPrefix(fields[0], "refs/heads/")
+						break
+					}
+				}
+			}
+		}
+	}
 	if branch == "" || branch == "HEAD" {
 		return "main"
 	}

internal/snapshot/capture.go

@@ -183,7 +183,7 @@ func CaptureNpm() ([]string, error) {
 	if len(lines) <= 1 {
 		return []string{}, nil
 	}
-	var packages []string
+	packages := []string{}
 	for _, line := range lines[1:] {
 		line = strings.TrimSpace(line)
 		if line == "" {