chore(deps): update dependency farcloser/limen to v0.13.0

.aqua/aqua-checksums.json

@@ -1,23 +1,23 @@
 {
   "checksums": [
     {
-      "id": "github_release/github.com/casey/just/1.58.0/just-1.58.0-aarch64-apple-darwin.tar.gz",
-      "checksum": "50AE3E996C974A0BF32EA7D10F495070DF33F1B43E0616B2769E3D4821ED8F48",
+      "id": "github_release/github.com/casey/just/1.59.0/just-1.59.0-aarch64-apple-darwin.tar.gz",
+      "checksum": "6574CEA774ED4CAE12E24B6AA11857DE33E80DAB4667CF628FD5840DF96A2A9D",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/casey/just/1.58.0/just-1.58.0-aarch64-unknown-linux-musl.tar.gz",
-      "checksum": "748237128C4C40CBDABC65E841D05CEBA13CC23A91EABA395495894C1D9764DF",
+      "id": "github_release/github.com/casey/just/1.59.0/just-1.59.0-aarch64-unknown-linux-musl.tar.gz",
+      "checksum": "23871B1702BFD550FB5F901778FD4290ECF2EE034A45A889FBE96D89B188086D",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/casey/just/1.58.0/just-1.58.0-x86_64-pc-windows-msvc.zip",
-      "checksum": "759F16FB7AA17C5C8B9594B6D4A8C1A6630DFD042CF2B3FF84841454D3D188DC",
+      "id": "github_release/github.com/casey/just/1.59.0/just-1.59.0-x86_64-pc-windows-msvc.zip",
+      "checksum": "9C5463E2D0974E31BEE71346AA5CBF19167DE1585A4ABC1BAE7B3B04604EA9C0",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/casey/just/1.58.0/just-1.58.0-x86_64-unknown-linux-musl.tar.gz",
-      "checksum": "4A5CC2F53E6F0F8C59092A6CC38291EB729D46A7DD95D3AE582008881B84931D",
+      "id": "github_release/github.com/casey/just/1.59.0/just-1.59.0-x86_64-unknown-linux-musl.tar.gz",
+      "checksum": "409044617B6F06517C1035E55CA38C8C856FF8B650E41BC2AA1EF82D5903A23E",
       "algorithm": "sha256"
     },
     {
@@ -46,28 +46,28 @@
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.12.1/limen_0.12.1_darwin_arm64.tar.gz",
-      "checksum": "2E32B06524608968CD0A0D7CB4165A7F31FD5CD2072EB9F46FE3E5D3020D5E3A",
+      "id": "github_release/github.com/farcloser/limen/v0.13.0/limen_0.13.0_darwin_arm64.tar.gz",
+      "checksum": "02ACAA3C7D7D5D09D253621C94657F3A314F91BD79B14CA24702A3CD0C127324",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.12.1/limen_0.12.1_linux_amd64.tar.gz",
-      "checksum": "B7B2011C0ED40F7E804CDDF441329FBA17A186F3F8F26BD4F3F4C6EE4678337F",
+      "id": "github_release/github.com/farcloser/limen/v0.13.0/limen_0.13.0_linux_amd64.tar.gz",
+      "checksum": "23FB86F58C599488CBD11E1887E739A7AA9ED7CE8DAD4495FD001B7CBFFEFF81",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.12.1/limen_0.12.1_linux_arm64.tar.gz",
-      "checksum": "43FA62F928B20086A8FA8E8736E144295B6272DF793F8880EC505CF6B428FD47",
+      "id": "github_release/github.com/farcloser/limen/v0.13.0/limen_0.13.0_linux_arm64.tar.gz",
+      "checksum": "1DBD0AF2FE6DE16FDBF9482FD1CCDCFB40551ECA0CD4A3B218030BBAEA249847",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.12.1/limen_0.12.1_windows_amd64.tar.gz",
-      "checksum": "2D3CB0E188470978669517FE52831420687C8902C690081AAB608AB8BECFDF9A",
+      "id": "github_release/github.com/farcloser/limen/v0.13.0/limen_0.13.0_windows_amd64.tar.gz",
+      "checksum": "B84995C3308DF6D4709AB821F884E0AB897F9A4E67EF19AB6BDA9FBD03208AA3",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.12.1/limen_0.12.1_windows_arm64.tar.gz",
-      "checksum": "52ADAD8DF300CAA2FE2B18A12C1DD05CCEC24488F5D6761C81BA14999613F43E",
+      "id": "github_release/github.com/farcloser/limen/v0.13.0/limen_0.13.0_windows_arm64.tar.gz",
+      "checksum": "724F1D5EC4B7B22F8C1A490D99D3962A928FD94CA5406008B7AF1079B4064B26",
       "algorithm": "sha256"
     },
     {

.aqua/aqua.yaml

@@ -18,7 +18,7 @@ registries:
 
 packages:
   # --- farcloser tools (local registry; standard once registered upstream) ---
-  - name: farcloser/limen@v0.12.1 # renovate: depName=farcloser/limen
+  - name: farcloser/limen@v0.13.0 # renovate: depName=farcloser/limen
     registry: local
   # --- toolchain + binary-release tools (standard registry, aqua-verified) ---
   - name: mikefarah/yq@v4.54.1

.github/actions/cache/action.yaml

@@ -1,6 +1,6 @@
 name: Job caches
 description: >
-  The caches a canonical job keeps: aqua's package store and, with go, the Go build and module caches, plus the linter's with linter-cache. Called three times per job, each mode once: attach (before setup-aqua), restore (right after setup-aqua, before the job links or runs a tool) and save (after the job's last command). On Windows they live in one disk image (windows-cache-image): attach restores and attaches it, since aqua's root is inside it, restore does nothing, and save detaches and saves it. On Linux and macOS attach does nothing, restore restores the store and the Go caches as files, and save saves them. Every save is on main only, and only on a miss: a cache a pull request run saves is scoped to that pull request and restorable by nothing else, and a key is never overwritten (the cache budget, caches.yaml). The Go caches and the image accumulate, so their keys carry the UTC day and main refreshes them at most once a day; the store is fully determined by its pins. What save needs, attach and restore leave in the job's environment, so save cannot use another key or path list, and a mode called twice in one job fails.
+  The caches a canonical job keeps: aqua's package store and, with go, the Go build and module caches, plus the linter's with linter-cache. Called three times per job, each mode once: attach (before setup-aqua), restore (right after setup-aqua, before the job links or runs a tool) and save (after the job's last command). On Windows they live in one disk image (windows-cache-image): attach restores and attaches it, since aqua's root is inside it, restore does nothing, and save detaches and saves it. On Linux and macOS attach does nothing, restore restores the store and the Go caches as files, and save saves them. Every save is on the default branch only, read from the event (a scheduled run is on it by definition), never assumed by name, and only on a miss: a cache a pull request run saves is scoped to that pull request and restorable by nothing else, and a key is never overwritten (the cache budget, caches.yaml). The Go caches and the image accumulate, so their keys carry the UTC day and the default branch refreshes them at most once a day; the store is fully determined by its pins. What save needs, attach and restore leave in the job's environment, so save cannot use another key or path list, and a mode called twice in one job fails.
 inputs:
   mode:
     description: attach, restore or save.
@@ -10,7 +10,7 @@ inputs:
     required: false
     default: 'true'
   linter-cache:
-    description: true to keep the linter's .build/cache with the Go caches (restore).
+    description: true to keep the linter's $LIMEN_BUILD/cache with the Go caches (restore).
     required: false
     default: 'false'
   aqua-fallback:
@@ -82,7 +82,7 @@ runs:
           echo "mod=$(aqua exec -- go env GOMODCACHE)"
           echo "version=$(aqua exec -- go env GOVERSION)"
           echo "day=$(date -u +%Y%m%d)"
-          if [ "$LINTER" = true ]; then echo "lint=.build/cache"; else echo "lint="; fi
+          if [ "$LINTER" = true ]; then echo "lint=${LIMEN_BUILD}/cache"; else echo "lint="; fi
         } >> "$GITHUB_OUTPUT"
 
     # An empty line in path is dropped, so without linter-cache the list is
@@ -125,20 +125,20 @@ runs:
           echo "LIMEN_CACHE_GO_PATHS_END"
         } >> "$GITHUB_ENV"
 
-    # --- save: main only, on a miss ---
-    - if: inputs.mode == 'save' && runner.os != 'Windows' && github.ref == 'refs/heads/main' && env.LIMEN_CACHE_AQUA_KEY != '' && env.LIMEN_CACHE_AQUA_HIT != 'true'
+    # --- save: the default branch only, on a miss ---
+    - if: inputs.mode == 'save' && runner.os != 'Windows' && (github.event_name == 'schedule' || github.ref == format('refs/heads/{0}', github.event.repository.default_branch)) && env.LIMEN_CACHE_AQUA_KEY != '' && env.LIMEN_CACHE_AQUA_HIT != 'true'
       uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ env.AQUA_ROOT_DIR }}/pkgs
         key: ${{ env.LIMEN_CACHE_AQUA_KEY }}
 
-    - if: inputs.mode == 'save' && runner.os != 'Windows' && github.ref == 'refs/heads/main' && env.LIMEN_CACHE_GO_KEY != '' && env.LIMEN_CACHE_GO_HIT != 'true'
+    - if: inputs.mode == 'save' && runner.os != 'Windows' && (github.event_name == 'schedule' || github.ref == format('refs/heads/{0}', github.event.repository.default_branch)) && env.LIMEN_CACHE_GO_KEY != '' && env.LIMEN_CACHE_GO_HIT != 'true'
       uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ env.LIMEN_CACHE_GO_PATHS }}
         key: ${{ env.LIMEN_CACHE_GO_KEY }}
 
-    - if: inputs.mode == 'save' && runner.os == 'Windows' && github.ref == 'refs/heads/main' && env.LIMEN_CACHE_IMAGE_KEY != '' && env.LIMEN_CACHE_IMAGE_HIT != 'true'
+    - if: inputs.mode == 'save' && runner.os == 'Windows' && (github.event_name == 'schedule' || github.ref == format('refs/heads/{0}', github.event.repository.default_branch)) && env.LIMEN_CACHE_IMAGE_KEY != '' && env.LIMEN_CACHE_IMAGE_HIT != 'true'
       uses: ./.github/actions/windows-cache-image
       with:
         mode: save

.github/actions/setup-aqua/action.yaml

@@ -32,6 +32,17 @@ runs:
         fi
         export AQUA_ROOT_DIR
         echo "AQUA_ROOT_DIR=${AQUA_ROOT_DIR}" >>"$GITHUB_ENV"
+        # The checkout's output directory, the path main.just's LIMEN_BUILD
+        # computes, for the steps after this one (cache paths, a project's own
+        # steps); a recipe computes it again itself. Kept when set: on windows
+        # the cache image is attached first and exports it. Equal to main.just's
+        # value only with the checkout at the workspace root (actions/checkout
+        # without `path:`), as every canonical workflow checks out.
+        LIMEN_BUILD="${LIMEN_BUILD:-$GITHUB_WORKSPACE/.build}"
+        if command -v cygpath >/dev/null 2>&1; then
+          LIMEN_BUILD="$(cygpath -m "$LIMEN_BUILD")"
+        fi
+        echo "LIMEN_BUILD=${LIMEN_BUILD}" >>"$GITHUB_ENV"
         tmp="$(mktemp -d)"
         # Retries for transient runner failures. Windows curl (schannel) refuses
         # a handshake when the CA's revocation server is unreachable (exit 35,

.github/actions/windows-cache-image/action.yaml

@@ -81,9 +81,13 @@ runs:
         } catch {
           Write-Host "Defender exclusion skipped: $_"
         }
-        # The linter cache lives under the workspace (main.just pins it there).
-        New-Item -ItemType Directory -Force -Path C:\vcache\golangci, "$env:GITHUB_WORKSPACE\.build" | Out-Null
-        New-Item -ItemType Junction -Path "$env:GITHUB_WORKSPACE\.build\cache" -Target C:\vcache\golangci | Out-Null
+        # The linter cache lives under the checkout's output directory
+        # (main.just's LIMEN_BUILD, the same path). This step runs before
+        # setup-aqua, so it is the one that exports it for the steps after.
+        $build = ($env:GITHUB_WORKSPACE -replace '\\', '/') + '/.build'
+        New-Item -ItemType Directory -Force -Path C:\vcache\golangci, $build | Out-Null
+        New-Item -ItemType Junction -Path "$build/cache" -Target C:\vcache\golangci | Out-Null
+        "LIMEN_BUILD=$build" >> $env:GITHUB_ENV
         "GOCACHE=C:\vcache\go-build" >> $env:GITHUB_ENV
         "GOMODCACHE=C:\vcache\mod" >> $env:GITHUB_ENV
         "AQUA_ROOT_DIR=C:/vcache/aqua" >> $env:GITHUB_ENV
@@ -93,7 +97,7 @@ runs:
       shell: pwsh
       run: |
         $ErrorActionPreference = 'Stop'
-        Remove-Item "$env:GITHUB_WORKSPACE\.build\cache" -Force
+        Remove-Item "$env:LIMEN_BUILD/cache" -Force
         Dismount-DiskImage -ImagePath C:\vhd\cache.vhdx | Out-Null
 
     - if: inputs.mode == 'save'

.github/workflows/caches.yaml

@@ -3,14 +3,14 @@
 # The cache budget. GitHub keeps 10 GB of Actions caches per repository and
 # evicts the least recently used beyond it, the current entries included, so
 # a repository over budget runs cold at random. The canonical lanes save on
-# main only (a cache a pull request run saves is scoped to that pull request
-# and restorable by nothing else), and every pin or go.sum change starts a new
-# generation of every key while the old one lingers until eviction (and the
-# caches that accumulate, Go's and the fuzz corpus, start one a day). This
-# keeps one generation per key on main: after each ci run on main, and once a
-# day, every entry under a canonical prefix that is not the newest of its
-# family is deleted. GitHub's own token, `gh` from the runner image; no
-# checkout, no third-party actions.
+# the default branch only (a cache a pull request run saves is scoped to that
+# pull request and restorable by nothing else), and every pin or go.sum change
+# starts a new generation of every key while the old one lingers until
+# eviction (and the caches that accumulate, Go's and the fuzz corpus, start
+# one a day). This keeps one generation per key on the default branch: after
+# each ci run there, and once a day, every entry under a canonical prefix that
+# is not the newest of its family is deleted. GitHub's own token, `gh` from
+# the runner image; no checkout, no third-party actions.
 name: caches
 
 on:
@@ -43,13 +43,15 @@ jobs:
       # Listing and deleting caches is an Actions write.
       actions: write
     steps:
-      - name: One generation per key on main
+      - name: One generation per key on the default branch
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
         run: |
-          # Main's entries, newest first. Listed before the loop so a refused
-          # token or a failed call fails the step: fed through a process
+          # The default branch's entries, newest first, the branch read from
+          # the repository, never assumed by name (a scheduled run has no
+          # event naming it). Listed before the loop so a refused token or a
+          # failed call fails the step: fed through a process
           # substitution, the loop would read nothing and pass, and the prune
           # would silently not happen. A family is a key without its UTC day
           # and content hash (and, for the Go caches, without the Go version,
@@ -60,7 +62,8 @@ jobs:
           # other's older generation. The first of each family is kept, the
           # rest deleted. Only the canonical prefixes; whatever else is in the
           # store is not ours to judge.
-          entries=$(gh cache list --ref refs/heads/main --limit 500 --sort created_at --order desc \
+          default_branch=$(gh api "repos/$GH_REPO" --jq .default_branch)
+          entries=$(gh cache list --ref "refs/heads/$default_branch" --limit 500 --sort created_at --order desc \
             --json id,key,version,sizeInBytes --jq '.[] | "\(.id)\t\(.key)\t\(.version)\t\(.sizeInBytes)"')
           kept=
           while IFS=$'\t' read -r id key version size; do

.github/workflows/limen-verify.yaml

@@ -106,9 +106,10 @@ jobs:
 
       # The cached corpus is what makes fuzzing cumulative across runs. Keyed
       # on the fuzz sources so a changed target restarts its corpus, and on
-      # the UTC day so that main saves what a day of runs found (a key is
-      # never overwritten); restore-keys keep the rest. Saved on main only
-      # (caches.yaml).
+      # the UTC day so that the default branch saves what a day of runs found
+      # (a key is never overwritten); restore-keys keep the rest. Saved on the
+      # default branch only (caches.yaml), read from the event, never assumed
+      # by name.
       - id: fuzzdir
         run: |
           echo "dir=$(go env GOCACHE)/fuzz" >> "$GITHUB_OUTPUT"
@@ -125,7 +126,7 @@ jobs:
       - name: Fuzz
         run: just do test go fuzz
 
-      - if: github.ref == 'refs/heads/main' && steps.corpus.outputs.cache-hit != 'true'
+      - if: (github.event_name == 'schedule' || github.ref == format('refs/heads/{0}', github.event.repository.default_branch)) && steps.corpus.outputs.cache-hit != 'true'
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.fuzzdir.outputs.dir }}
@@ -172,8 +173,9 @@ jobs:
       - name: Install every pinned tool
         run: aqua install
 
-      # Saved on main only, on a miss (caches.yaml); the verify leg that
-      # shares the key may have saved it first, and a key is never overwritten.
+      # Saved on the default branch only, on a miss (caches.yaml); the verify
+      # leg that shares the key may have saved it first, and a key is never
+      # overwritten.
       - uses: ./.github/actions/cache
         with:
           mode: save

.github/workflows/security.yaml

@@ -69,8 +69,8 @@ jobs:
       - name: Scan
         run: just security
 
-      # Saved on main only, on a miss (the cache budget: caches.yaml). The
-      # scheduled run is on main too.
+      # Saved on the default branch only, on a miss (the cache budget:
+      # caches.yaml); the scheduled run is on it by definition.
       - uses: ./.github/actions/cache
         with:
           mode: save

.limen/aqua.yaml

@@ -24,7 +24,7 @@ packages:
   # Not here: golang/go. The Go toolchain is each repository's own pin, in its
   # .aqua/aqua.yaml above the import (seeded once by `limen fix`, Renovate's
   # afterwards): a standard-library fix must not wait for a limen release.
-  - name: casey/just@1.58.0
+  - name: casey/just@1.59.0
   - name: koalaman/shellcheck@v0.11.0
   - name: forkcloser/yamlfmt@v0.1.0
     registry: local