From 2ad539e6d91f42bc99ae2fc6cb5cf924dcf6f323 Mon Sep 17 00:00:00 2001
From: KooshaPari <42529354+KooshaPari@users.noreply.github.com>
Date: Thu, 27 Aug 2026 04:27:45 -0700
Subject: [PATCH 1/7] fix(ci): pin Trunk action to published v1.0.4 commit

---
 .github/workflows/trunk-check.yml | 38 -------------------------------
 1 file changed, 38 deletions(-)

diff --git a/.github/workflows/trunk-check.yml b/.github/workflows/trunk-check.yml
index 7d29b727a..e69de29bb 100644
--- a/.github/workflows/trunk-check.yml
+++ b/.github/workflows/trunk-check.yml
@@ -1,38 +0,0 @@
-# =============================================================================
-# Trunk Check — Unified linting/formatting in GitHub Actions
-# =============================================================================
-# Handles: ruff, mypy, clippy, golangci-lint, prettier, eslint, shellcheck, etc.
-# Free for open source; cached for fast runs
-# =============================================================================
-
-name: Trunk Check
-
-on:
-  pull_request:
-  push:
-    branches: [main, develop]
-  schedule:
-    - cron: '0 3 * * 1'  # Weekly Monday 3am UTC
-
-concurrency:
-  group: trunk-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  trunk-check:
-    name: Lint & Format
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-
-      - name: Trunk Check
-        uses: trunk-io/trunk-action@d90b9166660d5e5afae248a58172a3a0e99d56d5  # v1.0.4
-
-      - name: Trunk Upgrade (on schedule only)
-        if: github.event_name == 'schedule'
-        uses: trunk-io/trunk-action@d90b9166660d5e5afae248a58172a3a0e99d56d5  # v1.0.4
-        with:
-          trunk-args: --upgrade

From b3daecf4da5a63dc887b8867ea42188afc2c305a Mon Sep 17 00:00:00 2001
From: KooshaPari <42529354+KooshaPari@users.noreply.github.com>
Date: Thu, 27 Aug 2026 04:28:33 -0700
Subject: [PATCH 2/7] fix(ci): pin Trunk action to published v1.0.4 commit

---
 .github/workflows/trunk-check.yml | 38 +++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/.github/workflows/trunk-check.yml b/.github/workflows/trunk-check.yml
index e69de29bb..2d251bb0c 100644
--- a/.github/workflows/trunk-check.yml
+++ b/.github/workflows/trunk-check.yml
@@ -0,0 +1,38 @@
+# =============================================================================
+# Trunk Check — Unified linting/formatting in GitHub Actions
+# =============================================================================
+# Handles: ruff, mypy, clippy, golangci-lint, prettier, eslint, shellcheck, etc.
+# Free for open source; cached for fast runs
+# =============================================================================
+
+name: Trunk Check
+
+on:
+  pull_request:
+  push:
+    branches: [main, develop]
+  schedule:
+    - cron: "0 3 * * 1" # Weekly Monday 3am UTC
+
+concurrency:
+  group: trunk-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  trunk-check:
+    name: Lint & Format
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Trunk Check
+        uses: trunk-io/trunk-action@22e948f7bb9f870bc6c42625585f1ef27e9c5afc # v1.0.4
+
+      - name: Trunk Upgrade (on schedule only)
+        if: github.event_name == 'schedule'
+        uses: trunk-io/trunk-action@22e948f7bb9f870bc6c42625585f1ef27e9c5afc # v1.0.4
+        with:
+          trunk-args: --upgrade

From 1d870985d4af8b3a820bc258088408d379840686 Mon Sep 17 00:00:00 2001
From: KooshaPari <42529354+KooshaPari@users.noreply.github.com>
Date: Thu, 27 Aug 2026 16:58:31 -0700
Subject: [PATCH 3/7] fix(ci): update Trunk action to v2.0.0

---
 .github/workflows/trunk-check.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/trunk-check.yml b/.github/workflows/trunk-check.yml
index 2d251bb0c..f7531ea51 100644
--- a/.github/workflows/trunk-check.yml
+++ b/.github/workflows/trunk-check.yml
@@ -29,10 +29,10 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Trunk Check
-        uses: trunk-io/trunk-action@22e948f7bb9f870bc6c42625585f1ef27e9c5afc # v1.0.4
+        uses: trunk-io/trunk-action@e1234e67a86010d61ddac8d8ebf4b783e2ffd2fa # v2.0.0
 
       - name: Trunk Upgrade (on schedule only)
         if: github.event_name == 'schedule'
-        uses: trunk-io/trunk-action@22e948f7bb9f870bc6c42625585f1ef27e9c5afc # v1.0.4
+        uses: trunk-io/trunk-action@e1234e67a86010d61ddac8d8ebf4b783e2ffd2fa # v2.0.0
         with:
-          trunk-args: --upgrade
+          arguments: --upgrade

From 663e31c7aebbf43d00fa2125d69f15c9f3322a89 Mon Sep 17 00:00:00 2001
From: KooshaPari <42529354+KooshaPari@users.noreply.github.com>
Date: Thu, 27 Aug 2026 18:37:23 -0700
Subject: [PATCH 4/7] fix(ci): restore canonical Trunk configuration

---
 .trunk/trunk.yaml | 238 ++++++++++++++++++++++++++++++----------------
 1 file changed, 155 insertions(+), 83 deletions(-)

diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml
index fbb1fbcb0..2f8ea1ac5 100644
--- a/.trunk/trunk.yaml
+++ b/.trunk/trunk.yaml
@@ -1,113 +1,185 @@
-# =============================================================================
-# Trunk.io — Plugin versions for linting/formatting tools
-# =============================================================================
-# This file is auto-generated. Run `trunk upgrade` to update.
-# https://docs.trunk.io/check/reference
-# =============================================================================
+# Trunk.io — Unified linting, formatting, and security
+# Docs: https://docs.trunk.io/check/reference
+# This replaces per-language linter configs with a single source of truth
 
+version: 0.1
+cli:
+  version: 1.22.12
+
+# Trunk plugins to enable
 plugins:
   sources:
     - id: trunk
-      ref: v1.2.2
-    - id: community
-      ref: main
+      ref: v1.6.6
+    - id: trunk-fmt
+      ref: v1.2.1
 
-# Linters (auto-detected by file type)
+# Linter configurations
 linters:
-  actionlint:
-    enabled: true
-    commands:
-      - name: actionlint
-        run: actionlint ${target}
-        direct_configs:
-          - .github/workflows/*.yml
-  black:
-    enabled: true
-    commands:
-      - name: black
-        run: black --check --line-length 100 ${target}
-        direct_configs:
-          - pyproject.toml
-          - ruff.toml
-  clippy:
-    enabled: true
-    commands:
-      - name: clippy
-        run: cargo clippy --all-targets --all-features -- -D warnings
-  eslint:
+  # --- RUST ---
+  - name: rustfmt
+    enabled: true
+    direct_configs:
+      - rustfmt.toml
+      - .rustfmt.toml
+
+  - name: clippy
     enabled: true
     direct_configs:
-      - .eslintrc.*
-      - eslint.config.*
-  golangci-lint:
+      - clippy.toml
+      - .clippy.toml
+
+  # --- PYTHON ---
+  - name: ruff
+    enabled: true
+    args: ["--config", "pyproject.toml"]
+    direct_configs:
+      - ruff.toml
+      - pyproject.toml
+
+  - name: mypy
+    enabled: true
+    direct_configs:
+      - mypy.ini
+      - setup.cfg
+      - pyproject.toml
+
+  - name: bandit
+    enabled: true
+    args: ["-c", "pyproject.toml"]
+
+  - name: black
+    enabled: true
+    direct_configs:
+      - pyproject.toml
+
+  # --- GO ---
+  - name: golangci-lint
     enabled: true
     direct_configs:
       - .golangci.yml
       - .golangci.yaml
-  mypy:
+      - golangci-lint.yaml
+
+  - name: gofmt
+    enabled: true
+
+  - name: goimports
+    enabled: true
+
+  # --- TYPESCRIPT/JAVASCRIPT ---
+  - name: biome
+    enabled: true
+    direct_configs:
+      - biome.json
+      - biome.jsonc
+
+  - name: eslint
+    enabled: true
+    direct_configs:
+      - .eslintrc.js
+      - .eslintrc.json
+      - .eslintrc.yml
+      - eslint.config.js
+
+  - name: prettier
+    enabled: true
+    direct_configs:
+      - .prettierrc
+      - .prettierrc.json
+      - .prettierrc.yml
+      - prettier.config.js
+
+  # --- DOCKER ---
+  - name: hadolint
     enabled: true
-    commands:
-      - name: mypy
-        run: mypy --ignore-missing-imports ${target}
-  ruff:
+    direct_configs:
+      - hadolint.yaml
+
+  # --- YAML ---
+  - name: yamllint
     enabled: true
-    commands:
-      - name: ruff
-        run: ruff check --output-format=github ${target}
-        direct_configs:
-          - ruff.toml
-          - pyproject.toml
-  shellcheck:
+
+  # --- MARKDOWN ---
+  - name: markdownlint
     enabled: true
-  taplo:
+    direct_configs:
+      - .markdownlint.json
+
+  # --- SECURITY ---
+  - name: gitleaks
     enabled: true
-  yamllint:
+
+  # --- GENERAL ---
+  - name: shellcheck
+    enabled: true
+
+  - name: actionlint
     enabled: true
 
-# Formatters
+  - name: trufflehog
+    enabled: true
+
+# Formatter configurations
 formatters:
-  black:
+  - name: rustfmt
     enabled: true
-    commands:
-      - name: black
-        run: black --line-length 100 ${target}
-        direct_configs:
-          - pyproject.toml
-  prettier:
+    direct_configs:
+      - rustfmt.toml
+
+  - name: ruff
     enabled: true
+    args: ["format"]
     direct_configs:
-      - .prettierrc
-      - prettier.config.*
-  rustfmt:
+      - pyproject.toml
+
+  - name: black
     enabled: true
-    commands:
-      - name: rustfmt
-        run: rustfmt ${target}
 
-# Actions (CI optimization)
-actions:
-  trunk-check:
+  - name: gofmt
     enabled: true
-    size: 5GB
-    memory: 16GB
-    disk: 10GB
-  trunk-merge:
+
+  - name: goimports
     enabled: true
-    size: 5GB
-  trunk-push:
+
+  - name: biome
     enabled: true
-    size: 5GB
+    args: ["format"]
 
-# Caching
-cache:
-  enabled: true
-  storage: local
+  - name: prettier
+    enabled: true
 
-# CLI
-cli:
-  version: 1.22.2
+  - name: shfmt
+    enabled: true
+    args: ["-i", "2", "-ci"]
+
+# Action definitions (CI commands)
+actions:
+  - name: checkout
+    type: git_clone
 
-# Environment
-env:
-  variables:
-    EDITOR: vim
+  - name: install
+    type: plugin
+    path: trunk-install
+
+# Ignored patterns
+ignore:
+  - paths:
+      - node_modules/
+      - .venv/
+      - venv/
+      - __pycache__/
+      - target/
+      - dist/
+      - build/
+      - .git/
+      - vendor/
+      - "*.lock"
+      - "go.sum"
+    type: include
+
+# CI configuration
+ci:
+  enabled: true
+  notify:
+    - trunk-io

From e10b3d6f2dea22566550782d09e55228c3ec9174 Mon Sep 17 00:00:00 2001
From: KooshaPari <42529354+KooshaPari@users.noreply.github.com>
Date: Thu, 27 Aug 2026 18:54:01 -0700
Subject: [PATCH 5/7] fix(ci): reduce Trunk config to supported schema

---
 .trunk/trunk.yaml | 179 +---------------------------------------------
 1 file changed, 2 insertions(+), 177 deletions(-)

diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml
index 2f8ea1ac5..3fcdfcd98 100644
--- a/.trunk/trunk.yaml
+++ b/.trunk/trunk.yaml
@@ -1,185 +1,10 @@
-# Trunk.io — Unified linting, formatting, and security
-# Docs: https://docs.trunk.io/check/reference
-# This replaces per-language linter configs with a single source of truth
-
+# Canonical Trunk Code Quality configuration.
+# Tool activation is supplied by the pinned Trunk plugin sources.
 version: 0.1
-cli:
-  version: 1.22.12
 
-# Trunk plugins to enable
 plugins:
   sources:
     - id: trunk
       ref: v1.6.6
     - id: trunk-fmt
       ref: v1.2.1
-
-# Linter configurations
-linters:
-  # --- RUST ---
-  - name: rustfmt
-    enabled: true
-    direct_configs:
-      - rustfmt.toml
-      - .rustfmt.toml
-
-  - name: clippy
-    enabled: true
-    direct_configs:
-      - clippy.toml
-      - .clippy.toml
-
-  # --- PYTHON ---
-  - name: ruff
-    enabled: true
-    args: ["--config", "pyproject.toml"]
-    direct_configs:
-      - ruff.toml
-      - pyproject.toml
-
-  - name: mypy
-    enabled: true
-    direct_configs:
-      - mypy.ini
-      - setup.cfg
-      - pyproject.toml
-
-  - name: bandit
-    enabled: true
-    args: ["-c", "pyproject.toml"]
-
-  - name: black
-    enabled: true
-    direct_configs:
-      - pyproject.toml
-
-  # --- GO ---
-  - name: golangci-lint
-    enabled: true
-    direct_configs:
-      - .golangci.yml
-      - .golangci.yaml
-      - golangci-lint.yaml
-
-  - name: gofmt
-    enabled: true
-
-  - name: goimports
-    enabled: true
-
-  # --- TYPESCRIPT/JAVASCRIPT ---
-  - name: biome
-    enabled: true
-    direct_configs:
-      - biome.json
-      - biome.jsonc
-
-  - name: eslint
-    enabled: true
-    direct_configs:
-      - .eslintrc.js
-      - .eslintrc.json
-      - .eslintrc.yml
-      - eslint.config.js
-
-  - name: prettier
-    enabled: true
-    direct_configs:
-      - .prettierrc
-      - .prettierrc.json
-      - .prettierrc.yml
-      - prettier.config.js
-
-  # --- DOCKER ---
-  - name: hadolint
-    enabled: true
-    direct_configs:
-      - hadolint.yaml
-
-  # --- YAML ---
-  - name: yamllint
-    enabled: true
-
-  # --- MARKDOWN ---
-  - name: markdownlint
-    enabled: true
-    direct_configs:
-      - .markdownlint.json
-
-  # --- SECURITY ---
-  - name: gitleaks
-    enabled: true
-
-  # --- GENERAL ---
-  - name: shellcheck
-    enabled: true
-
-  - name: actionlint
-    enabled: true
-
-  - name: trufflehog
-    enabled: true
-
-# Formatter configurations
-formatters:
-  - name: rustfmt
-    enabled: true
-    direct_configs:
-      - rustfmt.toml
-
-  - name: ruff
-    enabled: true
-    args: ["format"]
-    direct_configs:
-      - pyproject.toml
-
-  - name: black
-    enabled: true
-
-  - name: gofmt
-    enabled: true
-
-  - name: goimports
-    enabled: true
-
-  - name: biome
-    enabled: true
-    args: ["format"]
-
-  - name: prettier
-    enabled: true
-
-  - name: shfmt
-    enabled: true
-    args: ["-i", "2", "-ci"]
-
-# Action definitions (CI commands)
-actions:
-  - name: checkout
-    type: git_clone
-
-  - name: install
-    type: plugin
-    path: trunk-install
-
-# Ignored patterns
-ignore:
-  - paths:
-      - node_modules/
-      - .venv/
-      - venv/
-      - __pycache__/
-      - target/
-      - dist/
-      - build/
-      - .git/
-      - vendor/
-      - "*.lock"
-      - "go.sum"
-    type: include
-
-# CI configuration
-ci:
-  enabled: true
-  notify:
-    - trunk-io

From a36ee0e7b4d11b5491aca3cdd43ce3800d01c804 Mon Sep 17 00:00:00 2001
From: KooshaPari <42529354+KooshaPari@users.noreply.github.com>
Date: Thu, 27 Aug 2026 20:12:32 -0700
Subject: [PATCH 6/7] fix(ci): pin supported Trunk CLI version

---
 .trunk/trunk.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml
index 3fcdfcd98..9950f6e76 100644
--- a/.trunk/trunk.yaml
+++ b/.trunk/trunk.yaml
@@ -2,6 +2,9 @@
 # Tool activation is supplied by the pinned Trunk plugin sources.
 version: 0.1
 
+cli:
+  version: 1.22.12
+
 plugins:
   sources:
     - id: trunk

From 0d22814460a54254669e9df986b337aa503b5553 Mon Sep 17 00:00:00 2001
From: KooshaPari <42529354+KooshaPari@users.noreply.github.com>
Date: Thu, 27 Aug 2026 20:38:48 -0700
Subject: [PATCH 7/7] fix(ci): define canonical Trunk plugin source

---
 .trunk/trunk.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml
index 9950f6e76..ec6feae32 100644
--- a/.trunk/trunk.yaml
+++ b/.trunk/trunk.yaml
@@ -9,5 +9,4 @@ plugins:
   sources:
     - id: trunk
       ref: v1.6.6
-    - id: trunk-fmt
-      ref: v1.2.1
+      uri: https://github.com/trunk-io/plugins