chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](c10b8064de...95e58e9a2c)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependencies.yml

@@ -30,7 +30,7 @@ dependencies:
   plugins/kube-ps1:
     repo: jonmosco/kube-ps1
     branch: master
-    version: 9b41c091d5dd4a99e58cf58b5d98a4847937b1bb
+    version: e19c9ee867c5655814c384a6bf543e330e6ef1b7
     precopy: |
       set -e
       find . ! -name kube-ps1.sh ! -name LICENSE ! -name README.md -delete

.github/workflows/dependencies.yml

@@ -4,6 +4,9 @@ on:
   schedule:
     - cron: "0 6 * * 0"
 
+permissions:
+  contents: read
+
 jobs:
   check:
     name: Check for updates
@@ -13,7 +16,7 @@ jobs:
       contents: write # this is needed to push commits and branches
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
         with:
           egress-policy: audit
 
@@ -23,9 +26,9 @@ jobs:
           fetch-depth: 0
       - name: Authenticate as @ohmyzsh
         id: generate-token
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
         with:
-          app-id: ${{ secrets.OHMYZSH_APP_ID }}
+          client-id: ${{ secrets.OHMYZSH_CLIENT_ID }}
           private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}
       - name: Setup Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0

.github/workflows/dependencies/requirements.txt

@@ -1,7 +1,7 @@
 certifi==2026.2.25
-charset-normalizer==3.4.6
+charset-normalizer==3.4.7
 idna==3.11
 PyYAML==6.0.3
-requests==2.33.0
+requests==2.33.1
 semver==3.0.4
 urllib3==2.6.3

.github/workflows/installer.yml

@@ -26,7 +26,7 @@ jobs:
           - macos-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
         with:
           egress-policy: audit
 
@@ -47,7 +47,7 @@ jobs:
       - test
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
         with:
           egress-policy: audit
 

.github/workflows/main.yml

@@ -24,7 +24,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
         with:
           egress-policy: audit
 

.github/workflows/project.yml

@@ -17,14 +17,14 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
         with:
           egress-policy: audit
       - name: Authenticate as @ohmyzsh
         id: generate-token
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
         with:
-          app-id: ${{ secrets.OHMYZSH_APP_ID }}
+          client-id: ${{ secrets.OHMYZSH_CLIENT_ID }}
           private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}
       - name: Read project data
         env:

.github/workflows/scorecard.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
         with:
           egress-policy: audit
 
@@ -53,13 +53,13 @@ jobs:
           publish_results: true
 
       - name: "Upload artifact"
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
         with:
           sarif_file: results.sarif

plugins/kube-ps1/kube-ps1.plugin.zsh

@@ -55,7 +55,17 @@ _kube_ps1_shell_type() {
 _kube_ps1_init() {
   [[ -f "${_KUBE_PS1_DISABLE_PATH}" ]] && KUBE_PS1_ENABLED=off
 
-  case "$(_kube_ps1_shell_type)" in
+  # Detect shell type once and cache it
+  _KUBE_PS1_SHELL="$(_kube_ps1_shell_type)"
+
+  # Check tput availability once
+  if tput setaf 1 &> /dev/null; then
+    _KUBE_PS1_TPUT_AVAILABLE=true
+  else
+    _KUBE_PS1_TPUT_AVAILABLE=false
+  fi
+
+  case "${_KUBE_PS1_SHELL}" in
     "zsh")
       _KUBE_PS1_OPEN_ESC="%{"
       _KUBE_PS1_CLOSE_ESC="%}"
@@ -96,10 +106,10 @@ _kube_ps1_color_fg() {
   if [[ "${_KUBE_PS1_FG_CODE}" == "default" ]]; then
     _KUBE_PS1_FG_CODE="${_KUBE_PS1_DEFAULT_FG}"
     return
-  elif [[ "$(_kube_ps1_shell_type)" == "zsh" ]]; then
+  elif [[ "${_KUBE_PS1_SHELL}" == "zsh" ]]; then
     _KUBE_PS1_FG_CODE="%F{$_KUBE_PS1_FG_CODE}"
-  elif [[ "$(_kube_ps1_shell_type)" == "bash" ]]; then
-    if tput setaf 1 &> /dev/null; then
+  elif [[ "${_KUBE_PS1_SHELL}" == "bash" ]]; then
+    if [[ "${_KUBE_PS1_TPUT_AVAILABLE}" == "true" ]]; then
       _KUBE_PS1_FG_CODE="$(tput setaf "${_KUBE_PS1_FG_CODE}")"
     elif [[ $_KUBE_PS1_FG_CODE -ge 0 ]] && [[ $_KUBE_PS1_FG_CODE -le 256 ]]; then
       _KUBE_PS1_FG_CODE="\033[38;5;${_KUBE_PS1_FG_CODE}m"
@@ -129,15 +139,15 @@ _kube_ps1_color_bg() {
   if [[ "${_KUBE_PS1_BG_CODE}" == "default" ]]; then
     _KUBE_PS1_FG_CODE="${_KUBE_PS1_DEFAULT_BG}"
     return
-  elif [[ "$(_kube_ps1_shell_type)" == "zsh" ]]; then
+  elif [[ "${_KUBE_PS1_SHELL}" == "zsh" ]]; then
     _KUBE_PS1_BG_CODE="%K{$_KUBE_PS1_BG_CODE}"
-  elif [[ "$(_kube_ps1_shell_type)" == "bash" ]]; then
-    if tput setaf 1 &> /dev/null; then
+  elif [[ "${_KUBE_PS1_SHELL}" == "bash" ]]; then
+    if [[ "${_KUBE_PS1_TPUT_AVAILABLE}" == "true" ]]; then
       _KUBE_PS1_BG_CODE="$(tput setab "${_KUBE_PS1_BG_CODE}")"
     elif [[ $_KUBE_PS1_BG_CODE -ge 0 ]] && [[ $_KUBE_PS1_BG_CODE -le 256 ]]; then
       _KUBE_PS1_BG_CODE="\033[48;5;${_KUBE_PS1_BG_CODE}m"
     else
-      _KUBE_PS1_BG_CODE="${DEFAULT_BG}"
+      _KUBE_PS1_BG_CODE="${_KUBE_PS1_DEFAULT_BG}"
     fi
   fi
   echo "${_KUBE_PS1_OPEN_ESC}${_KUBE_PS1_BG_CODE}${_KUBE_PS1_CLOSE_ESC}"
@@ -174,7 +184,7 @@ _kube_ps1_symbol() {
       symbol="$(_kube_ps1_color_fg ${oc_symbol_color})${oc_glyph}${KUBE_PS1_RESET_COLOR}"
       ;;
     *)
-      case "$(_kube_ps1_shell_type)" in
+      case "${_KUBE_PS1_SHELL}" in
         bash)
           if ((BASH_VERSINFO[0] >= 4)) && [[ $'\u2388' != "\\u2388" ]]; then
             symbol="$(_kube_ps1_color_fg $custom_symbol_color)${symbol_default}${KUBE_PS1_RESET_COLOR}"
@@ -212,7 +222,7 @@ _kube_ps1_file_newer_than() {
   local file=$1
   local check_time=$2
 
-  if [[ "$(_kube_ps1_shell_type)" == "zsh" ]]; then
+  if [[ "${_KUBE_PS1_SHELL}" == "zsh" ]]; then
     # Use zstat '-F %s.%s' to make it compatible with low zsh version (eg: 5.0.2)
     mtime=$(zstat -L +mtime -F %s.%s "${file}")
   elif stat -c "%s" /dev/null &> /dev/null; then
@@ -292,13 +302,13 @@ _kube_ps1_get_ns() {
 
 _kube_ps1_get_context_ns() {
   # Set the command time
-  if [[ "$(_kube_ps1_shell_type)" == "bash" ]]; then
+  if [[ "${_KUBE_PS1_SHELL}" == "bash" ]]; then
     if ((BASH_VERSINFO[0] >= 4 && BASH_VERSINFO[1] >= 2)); then
       _KUBE_PS1_LAST_TIME=$(printf '%(%s)T')
     else
       _KUBE_PS1_LAST_TIME=$(date +%s)
     fi
-  elif [[ "$(_kube_ps1_shell_type)" == "zsh" ]]; then
+  elif [[ "${_KUBE_PS1_SHELL}" == "zsh" ]]; then
     _KUBE_PS1_LAST_TIME=$EPOCHREALTIME
   fi
 
@@ -325,7 +335,7 @@ Toggle kube-ps1 prompt on
 
 Usage: kubeon [-g | --global] [-h | --help]
 
-With no arguments, turn oon kube-ps1 status for this shell instance (default).
+With no arguments, turn on kube-ps1 status for this shell instance (default).
 
   -g --global  turn on kube-ps1 status globally
   -h --help    print this message

plugins/opentofu/opentofu.plugin.zsh

@@ -30,14 +30,20 @@ function tofu_version_prompt_info() {
 alias tt='tofu'
 alias tta='tofu apply'
 alias tta!='tofu apply -auto-approve'
+alias ttap='tofu apply -parallelism=1'
+alias ttapp='tofu apply tfplan'
 alias ttc='tofu console'
 alias ttd='tofu destroy'
 alias ttd!='tofu destroy -auto-approve'
 alias ttf='tofu fmt'
 alias ttfr='tofu fmt -recursive'
 alias tti='tofu init'
+alias ttir='tofu init -reconfigure'
+alias ttiu='tofu init -upgrade'
+alias ttiur='tofu init -upgrade -reconfigure'
 alias tto='tofu output'
 alias ttp='tofu plan'
+alias ttpo='tofu plan -out tfplan'
 alias ttv='tofu validate'
 alias tts='tofu state'
 alias ttsh='tofu show'

plugins/terraform/terraform.plugin.zsh

@@ -4,21 +4,21 @@ function tf_prompt_info() {
   # check if in terraform dir and file exists
   [[ -d "${TF_DATA_DIR:-.terraform}" && -r "${TF_DATA_DIR:-.terraform}/environment" ]] || return
 
-  local workspace="$(< "${TF_DATA_DIR:-.terraform}/environment")"
+  local workspace="$(<"${TF_DATA_DIR:-.terraform}/environment")"
   echo "${ZSH_THEME_TF_PROMPT_PREFIX-[}${workspace:gs/%/%%}${ZSH_THEME_TF_PROMPT_SUFFIX-]}"
 }
 
 function tf_version_prompt_info() {
-    local terraform_version
-    terraform_version=$(terraform --version | head -n 1 | cut -d ' ' -f 2)
-    echo "${ZSH_THEME_TF_VERSION_PROMPT_PREFIX-[}${terraform_version:gs/%/%%}${ZSH_THEME_TF_VERSION_PROMPT_SUFFIX-]}"
+  local terraform_version
+  terraform_version=$(terraform --version | head -n 1 | cut -d ' ' -f 2)
+  echo "${ZSH_THEME_TF_VERSION_PROMPT_PREFIX-[}${terraform_version:gs/%/%%}${ZSH_THEME_TF_VERSION_PROMPT_SUFFIX-]}"
 }
 
-
 alias tf='terraform'
 alias tfa='terraform apply'
 alias tfa!='terraform apply -auto-approve'
 alias tfap='terraform apply -parallelism=1'
+alias tfapp='terraform apply tfplan'
 alias tfc='terraform console'
 alias tfd='terraform destroy'
 alias tfd!='terraform destroy -auto-approve'
@@ -31,6 +31,7 @@ alias tfiu='terraform init -upgrade'
 alias tfiur='terraform init -upgrade -reconfigure'
 alias tfo='terraform output'
 alias tfp='terraform plan'
+alias tfpo='terraform plan -out tfplan'
 alias tfv='terraform validate'
 alias tfs='terraform state'
 alias tft='terraform test'