Merge d2ff9d35b3 into 7c10d9839f

Bumps [charset-normalizer](https://github.com/jawah/charset_normalizer) from 3.4.6 to 3.4.7.
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/jawah/charset_normalizer/compare/3.4.6...3.4.7)

---
updated-dependencies:
- dependency-name: charset-normalizer
  dependency-version: 3.4.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/dependencies.yml

@@ -30,7 +30,7 @@ dependencies:
   plugins/kube-ps1:
     repo: jonmosco/kube-ps1
     branch: master
-    version: 9b41c091d5dd4a99e58cf58b5d98a4847937b1bb
+    version: e19c9ee867c5655814c384a6bf543e330e6ef1b7
     precopy: |
       set -e
       find . ! -name kube-ps1.sh ! -name LICENSE ! -name README.md -delete

.github/workflows/dependencies.yml

@@ -13,7 +13,7 @@ jobs:
       contents: write # this is needed to push commits and branches
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
         with:
           egress-policy: audit
 

.github/workflows/dependencies/requirements.txt

@@ -1,7 +1,7 @@
 certifi==2026.2.25
-charset-normalizer==3.4.6
+charset-normalizer==3.4.7
 idna==3.11
 PyYAML==6.0.3
-requests==2.33.0
+requests==2.33.1
 semver==3.0.4
 urllib3==2.6.3

.github/workflows/installer.yml

@@ -26,7 +26,7 @@ jobs:
           - macos-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
         with:
           egress-policy: audit
 
@@ -47,7 +47,7 @@ jobs:
       - test
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
         with:
           egress-policy: audit
 

.github/workflows/main.yml

@@ -24,7 +24,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
         with:
           egress-policy: audit
 

.github/workflows/project.yml

@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
         with:
           egress-policy: audit
       - name: Authenticate as @ohmyzsh

.github/workflows/scorecard.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
         with:
           egress-policy: audit
 

lib/completion.zsh

@@ -13,18 +13,73 @@ setopt always_to_end
 bindkey -M menuselect '^o' accept-and-infer-next-history
 zstyle ':completion:*:*:*:*:*' menu select
 
-# case insensitive (all), partial-word and substring completion
-if [[ "$CASE_SENSITIVE" = true ]]; then
-  zstyle ':completion:*' matcher-list 'r:|=*' 'l:|=* r:|=*'
-else
-  if [[ "$HYPHEN_INSENSITIVE" = true ]]; then
-    zstyle ':completion:*' matcher-list 'm:{[:lower:][:upper:]-_}={[:upper:][:lower:]_-}' 'r:|=*' 'l:|=* r:|=*'
-  else
-    zstyle ':completion:*' matcher-list 'm:{[:lower:][:upper:]}={[:upper:][:lower:]}' 'r:|=*' 'l:|=* r:|=*'
-  fi
-fi
+
+# Completion matcher configuration:
+# - case-sensitive: if 'yes', matching is case-sensitive (default: no, case-insensitive)
+# - hyphen-insensitive: if 'yes', treat hyphens and underscores as equivalent (default: no)
+# - substring-match: if 'yes', match substrings anywhere in completion (e.g., "de" matches "abcdef") (default: yes)
+# - fuzzy-match: if 'yes', match characters with gaps (e.g., "ad" matches "abcdef") (default: no)
+#   Note: fuzzy-match is more permissive and may impact performance; it includes substring behavior
+
+# Support legacy environment variables (will be deprecated)
+[[ "$CASE_SENSITIVE" = true ]] && zstyle ':omz:completion' case-sensitive 'yes'
+[[ "$HYPHEN_INSENSITIVE" = true ]] && zstyle ':omz:completion' hyphen-insensitive 'yes'
 unset CASE_SENSITIVE HYPHEN_INSENSITIVE
 
+# Set defaults if not already configured
+zstyle -s ':omz:completion' case-sensitive _ || zstyle ':omz:completion' case-sensitive 'no'
+zstyle -s ':omz:completion' hyphen-insensitive _ || zstyle ':omz:completion' hyphen-insensitive 'no'
+zstyle -s ':omz:completion' substring-match _ || zstyle ':omz:completion' substring-match 'yes'
+zstyle -s ':omz:completion' fuzzy-match _ || zstyle ':omz:completion' fuzzy-match 'no'
+
+# Build matcher-list based on enabled features
+() {
+  local -a matchers=()
+  local -i case_sensitive hyphen_insensitive substring_match fuzzy_match
+
+  # Query zstyle settings (convert to 0 or 1)
+  zstyle -t ':omz:completion' case-sensitive && case_sensitive=1 || case_sensitive=0
+  zstyle -t ':omz:completion' hyphen-insensitive && hyphen_insensitive=1 || hyphen_insensitive=0
+  zstyle -t ':omz:completion' substring-match && substring_match=1 || substring_match=0
+  zstyle -t ':omz:completion' fuzzy-match && fuzzy_match=1 || fuzzy_match=0
+  
+  # Matcher 1: Case and hyphen sensitivity
+  if (( ! case_sensitive )); then
+    if (( hyphen_insensitive )); then
+      # Case-insensitive + hyphen-insensitive
+      matchers+=('m:{[:lower:][:upper:]-_}={[:upper:][:lower:]_-}')
+    else
+      # Case-insensitive only
+      matchers+=('m:{[:lower:][:upper:]}={[:upper:][:lower:]}')
+    fi
+  else
+    if (( hyphen_insensitive )); then
+      # Case-sensitive + hyphen-insensitive
+      matchers+=('m:{-_}={_-}')
+    fi
+    # If both case-sensitive and hyphen-sensitive, no first matcher needed
+  fi
+
+  # Matcher 2: Partial word completion (left anchor)
+  # Matches from the left side of words: "ab" matches "abcd"
+  matchers+=('r:|=*')
+
+  # Matcher 3 & 4: Substring and fuzzy match
+  if (( fuzzy_match )); then
+    # Fuzzy match: allows match characters with gaps, also includes substring behavior
+    # "ad" can match "abcdef" (a...d...), very permissive
+    matchers+=('r:|?=**')
+  elif (( substring_match )); then
+    # Substring match: matches contiguous substrings anywhere
+    # "de" matches "abcdef", but "ad" would not match
+    matchers+=('l:|=* r:|=*')
+  fi
+
+  # Apply the final matcher-list
+  zstyle ':completion:*' matcher-list $matchers
+}
+
+
 # Complete . and .. special directories
 zstyle ':completion:*' special-dirs true
 

plugins/kube-ps1/kube-ps1.plugin.zsh

@@ -55,7 +55,17 @@ _kube_ps1_shell_type() {
 _kube_ps1_init() {
   [[ -f "${_KUBE_PS1_DISABLE_PATH}" ]] && KUBE_PS1_ENABLED=off
 
-  case "$(_kube_ps1_shell_type)" in
+  # Detect shell type once and cache it
+  _KUBE_PS1_SHELL="$(_kube_ps1_shell_type)"
+
+  # Check tput availability once
+  if tput setaf 1 &> /dev/null; then
+    _KUBE_PS1_TPUT_AVAILABLE=true
+  else
+    _KUBE_PS1_TPUT_AVAILABLE=false
+  fi
+
+  case "${_KUBE_PS1_SHELL}" in
     "zsh")
       _KUBE_PS1_OPEN_ESC="%{"
       _KUBE_PS1_CLOSE_ESC="%}"
@@ -96,10 +106,10 @@ _kube_ps1_color_fg() {
   if [[ "${_KUBE_PS1_FG_CODE}" == "default" ]]; then
     _KUBE_PS1_FG_CODE="${_KUBE_PS1_DEFAULT_FG}"
     return
-  elif [[ "$(_kube_ps1_shell_type)" == "zsh" ]]; then
+  elif [[ "${_KUBE_PS1_SHELL}" == "zsh" ]]; then
     _KUBE_PS1_FG_CODE="%F{$_KUBE_PS1_FG_CODE}"
-  elif [[ "$(_kube_ps1_shell_type)" == "bash" ]]; then
-    if tput setaf 1 &> /dev/null; then
+  elif [[ "${_KUBE_PS1_SHELL}" == "bash" ]]; then
+    if [[ "${_KUBE_PS1_TPUT_AVAILABLE}" == "true" ]]; then
       _KUBE_PS1_FG_CODE="$(tput setaf "${_KUBE_PS1_FG_CODE}")"
     elif [[ $_KUBE_PS1_FG_CODE -ge 0 ]] && [[ $_KUBE_PS1_FG_CODE -le 256 ]]; then
       _KUBE_PS1_FG_CODE="\033[38;5;${_KUBE_PS1_FG_CODE}m"
@@ -129,15 +139,15 @@ _kube_ps1_color_bg() {
   if [[ "${_KUBE_PS1_BG_CODE}" == "default" ]]; then
     _KUBE_PS1_FG_CODE="${_KUBE_PS1_DEFAULT_BG}"
     return
-  elif [[ "$(_kube_ps1_shell_type)" == "zsh" ]]; then
+  elif [[ "${_KUBE_PS1_SHELL}" == "zsh" ]]; then
     _KUBE_PS1_BG_CODE="%K{$_KUBE_PS1_BG_CODE}"
-  elif [[ "$(_kube_ps1_shell_type)" == "bash" ]]; then
-    if tput setaf 1 &> /dev/null; then
+  elif [[ "${_KUBE_PS1_SHELL}" == "bash" ]]; then
+    if [[ "${_KUBE_PS1_TPUT_AVAILABLE}" == "true" ]]; then
       _KUBE_PS1_BG_CODE="$(tput setab "${_KUBE_PS1_BG_CODE}")"
     elif [[ $_KUBE_PS1_BG_CODE -ge 0 ]] && [[ $_KUBE_PS1_BG_CODE -le 256 ]]; then
       _KUBE_PS1_BG_CODE="\033[48;5;${_KUBE_PS1_BG_CODE}m"
     else
-      _KUBE_PS1_BG_CODE="${DEFAULT_BG}"
+      _KUBE_PS1_BG_CODE="${_KUBE_PS1_DEFAULT_BG}"
     fi
   fi
   echo "${_KUBE_PS1_OPEN_ESC}${_KUBE_PS1_BG_CODE}${_KUBE_PS1_CLOSE_ESC}"
@@ -174,7 +184,7 @@ _kube_ps1_symbol() {
       symbol="$(_kube_ps1_color_fg ${oc_symbol_color})${oc_glyph}${KUBE_PS1_RESET_COLOR}"
       ;;
     *)
-      case "$(_kube_ps1_shell_type)" in
+      case "${_KUBE_PS1_SHELL}" in
         bash)
           if ((BASH_VERSINFO[0] >= 4)) && [[ $'\u2388' != "\\u2388" ]]; then
             symbol="$(_kube_ps1_color_fg $custom_symbol_color)${symbol_default}${KUBE_PS1_RESET_COLOR}"
@@ -212,7 +222,7 @@ _kube_ps1_file_newer_than() {
   local file=$1
   local check_time=$2
 
-  if [[ "$(_kube_ps1_shell_type)" == "zsh" ]]; then
+  if [[ "${_KUBE_PS1_SHELL}" == "zsh" ]]; then
     # Use zstat '-F %s.%s' to make it compatible with low zsh version (eg: 5.0.2)
     mtime=$(zstat -L +mtime -F %s.%s "${file}")
   elif stat -c "%s" /dev/null &> /dev/null; then
@@ -292,13 +302,13 @@ _kube_ps1_get_ns() {
 
 _kube_ps1_get_context_ns() {
   # Set the command time
-  if [[ "$(_kube_ps1_shell_type)" == "bash" ]]; then
+  if [[ "${_KUBE_PS1_SHELL}" == "bash" ]]; then
     if ((BASH_VERSINFO[0] >= 4 && BASH_VERSINFO[1] >= 2)); then
       _KUBE_PS1_LAST_TIME=$(printf '%(%s)T')
     else
       _KUBE_PS1_LAST_TIME=$(date +%s)
     fi
-  elif [[ "$(_kube_ps1_shell_type)" == "zsh" ]]; then
+  elif [[ "${_KUBE_PS1_SHELL}" == "zsh" ]]; then
     _KUBE_PS1_LAST_TIME=$EPOCHREALTIME
   fi
 
@@ -325,7 +335,7 @@ Toggle kube-ps1 prompt on
 
 Usage: kubeon [-g | --global] [-h | --help]
 
-With no arguments, turn oon kube-ps1 status for this shell instance (default).
+With no arguments, turn on kube-ps1 status for this shell instance (default).
 
   -g --global  turn on kube-ps1 status globally
   -h --help    print this message

plugins/opentofu/opentofu.plugin.zsh

@@ -30,14 +30,20 @@ function tofu_version_prompt_info() {
 alias tt='tofu'
 alias tta='tofu apply'
 alias tta!='tofu apply -auto-approve'
+alias ttap='tofu apply -parallelism=1'
+alias ttapp='tofu apply tfplan'
 alias ttc='tofu console'
 alias ttd='tofu destroy'
 alias ttd!='tofu destroy -auto-approve'
 alias ttf='tofu fmt'
 alias ttfr='tofu fmt -recursive'
 alias tti='tofu init'
+alias ttir='tofu init -reconfigure'
+alias ttiu='tofu init -upgrade'
+alias ttiur='tofu init -upgrade -reconfigure'
 alias tto='tofu output'
 alias ttp='tofu plan'
+alias ttpo='tofu plan -out tfplan'
 alias ttv='tofu validate'
 alias tts='tofu state'
 alias ttsh='tofu show'

plugins/terraform/terraform.plugin.zsh

@@ -4,21 +4,21 @@ function tf_prompt_info() {
   # check if in terraform dir and file exists
   [[ -d "${TF_DATA_DIR:-.terraform}" && -r "${TF_DATA_DIR:-.terraform}/environment" ]] || return
 
-  local workspace="$(< "${TF_DATA_DIR:-.terraform}/environment")"
+  local workspace="$(<"${TF_DATA_DIR:-.terraform}/environment")"
   echo "${ZSH_THEME_TF_PROMPT_PREFIX-[}${workspace:gs/%/%%}${ZSH_THEME_TF_PROMPT_SUFFIX-]}"
 }
 
 function tf_version_prompt_info() {
-    local terraform_version
-    terraform_version=$(terraform --version | head -n 1 | cut -d ' ' -f 2)
-    echo "${ZSH_THEME_TF_VERSION_PROMPT_PREFIX-[}${terraform_version:gs/%/%%}${ZSH_THEME_TF_VERSION_PROMPT_SUFFIX-]}"
+  local terraform_version
+  terraform_version=$(terraform --version | head -n 1 | cut -d ' ' -f 2)
+  echo "${ZSH_THEME_TF_VERSION_PROMPT_PREFIX-[}${terraform_version:gs/%/%%}${ZSH_THEME_TF_VERSION_PROMPT_SUFFIX-]}"
 }
 
-
 alias tf='terraform'
 alias tfa='terraform apply'
 alias tfa!='terraform apply -auto-approve'
 alias tfap='terraform apply -parallelism=1'
+alias tfapp='terraform apply tfplan'
 alias tfc='terraform console'
 alias tfd='terraform destroy'
 alias tfd!='terraform destroy -auto-approve'
@@ -31,6 +31,7 @@ alias tfiu='terraform init -upgrade'
 alias tfiur='terraform init -upgrade -reconfigure'
 alias tfo='terraform output'
 alias tfp='terraform plan'
+alias tfpo='terraform plan -out tfplan'
 alias tfv='terraform validate'
 alias tfs='terraform state'
 alias tft='terraform test'