chore: import upstream snapshot with attribution

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,44 @@
+# https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning
+name: CodeQL
+
+on:
+  push:
+    branches: [ master, devel ]
+  pull_request:
+    branches: [ master ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    permissions:
+      actions: read  # for github/codeql-action/init to get workflow details
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/autobuild to send a status report
+    name: Analyze
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ['go']
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v7
+      with:
+        fetch-depth: 0
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ matrix.language }}
+
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v4
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v4

.github/workflows/depsreview.yaml

@@ -0,0 +1,14 @@
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout Repository'
+        uses: actions/checkout@v7
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@v5

.github/workflows/labeler.yml

@@ -0,0 +1,17 @@
+name: Label PRs
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/labeler@v6
+        with:
+          configuration-path: .github/labeler.yml

.github/workflows/linux.yml

@@ -0,0 +1,58 @@
+---
+name: build
+
+on:
+  push:
+    branches: [ master, devel ]
+  pull_request:
+    branches: [ master, devel ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  LANG: C.UTF-8
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    steps:
+    - uses: actions/checkout@v7
+      with:
+        fetch-depth: 0
+
+    - name: Set up Go
+      uses: actions/setup-go@v6
+      with:
+        go-version: "1.23"
+
+    - name: Setup Ruby
+      uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1
+      with:
+        ruby-version: 3.4.6
+
+    - name: Install packages
+      run: |
+        sudo install -d -m 0755 /etc/apt/keyrings
+        wget -qO- https://apt.fury.io/nushell/gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/fury-nushell.gpg
+        echo "deb [signed-by=/etc/apt/keyrings/fury-nushell.gpg] https://apt.fury.io/nushell/ /" | sudo tee /etc/apt/sources.list.d/fury-nushell.list
+        sudo apt-get update
+        sudo apt-get install --yes zsh fish tmux shfmt nushell
+
+    - name: Install Ruby gems
+      run: bundle install
+
+    - name: Rubocop
+      run: make lint
+
+    - name: Unit test
+      run: make test
+
+    - name: Fuzz test
+      run: |
+        go test ./src/algo/ -fuzz=FuzzIndexByteTwo -fuzztime=5s
+        go test ./src/algo/ -fuzz=FuzzLastIndexByteTwo -fuzztime=5s
+
+    - name: Integration test
+      run: make install && ./install --all && tmux new-session -d && ruby test/runner.rb --verbose

.github/workflows/macos.yml

@@ -0,0 +1,45 @@
+---
+name: Test fzf on macOS
+
+on:
+  push:
+    branches: [ master, devel ]
+  pull_request:
+    branches: [ master ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: macos-latest
+    steps:
+    - uses: actions/checkout@v7
+      with:
+        fetch-depth: 0
+
+    - name: Set up Go
+      uses: actions/setup-go@v6
+      with:
+        go-version: "1.23"
+
+    - name: Setup Ruby
+      uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1
+      with:
+        ruby-version: 3.0.0
+
+    - name: Install packages
+      run: HOMEBREW_NO_INSTALL_CLEANUP=1 brew install fish zsh tmux shfmt
+
+    - name: Install Ruby gems
+      run: gem install --no-document minitest:5.14.2 rubocop:1.0.0 rubocop-minitest:0.10.1 rubocop-performance:1.8.1
+
+    - name: Rubocop
+      run: rubocop --require rubocop-minitest --require rubocop-performance
+
+    - name: Unit test
+      run: make test
+
+    - name: Integration test
+      run: make install && ./install --all && LC_ALL=C tmux new-session -d && ruby test/test_go.rb --verbose

.github/workflows/release.yml

@@ -0,0 +1,76 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to validate (e.g. 0.73.0).'
+        type: string
+        required: true
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: macos-latest
+    environment: release
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Determine version
+        id: ver
+        run: |
+          if [ "${{ github.event_name }}" = "push" ]; then
+            v=${GITHUB_REF_NAME#v}
+          else
+            v='${{ inputs.version }}'
+          fi
+          echo "version=$v" >> "$GITHUB_OUTPUT"
+          echo "Resolved version: '$v'"
+
+      - name: Verify version consistency
+        run: |
+          set -e
+          V='${{ steps.ver.outputs.version }}'
+          R=$(echo "$V" | sed 's/\./\\./g')
+          grep -q "^${R}$" CHANGELOG.md
+          grep -qF "\"fzf ${V}\"" man/man1/fzf.1
+          grep -qF "\"fzf ${V}\"" man/man1/fzf-tmux.1
+          grep -qF "${V}" install
+          grep -qF "${V}" install.ps1
+
+      - name: Extract release notes
+        run: |
+          set -e
+          mkdir -p tmp
+          V='${{ steps.ver.outputs.version }}'
+          R=$(echo "$V" | sed 's/\./\\./g')
+          sed -n "/^${R}$/,/^[0-9]/p" CHANGELOG.md \
+            | tail -r | sed '1,/^ *$/d' | tail -r | sed '1,2d' \
+            | tee tmp/release-note
+
+      - name: Run goreleaser
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          version: latest
+          args: >-
+            ${{ github.event_name == 'push'
+                && 'release --clean --release-notes tmp/release-note'
+                || 'release --snapshot --clean --skip=publish' }}
+        env:
+          GITHUB_TOKEN:           ${{ secrets.RELEASE_PAT }}
+          MACOS_SIGN_P12:         ${{ secrets.MACOS_SIGN_P12 }}
+          MACOS_SIGN_PASSWORD:    ${{ secrets.MACOS_SIGN_PASSWORD }}
+          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
+          MACOS_NOTARY_KEY_ID:    ${{ secrets.MACOS_NOTARY_KEY_ID }}
+          MACOS_NOTARY_KEY:       ${{ secrets.MACOS_NOTARY_KEY }}

.github/workflows/typos.yml

@@ -0,0 +1,10 @@
+name: "Spell Check"
+on: [pull_request]
+
+jobs:
+  typos:
+    name: Spell Check with Typos
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v7
+    - uses: crate-ci/typos@685eb3d55be2f85191e8c84acb9f44d7756f84ab # v1.29.4

.github/workflows/winget.yml

@@ -0,0 +1,21 @@
+name: Publish to Winget
+on:
+  release:
+    types: [released]
+  workflow_dispatch:
+    inputs:
+      release-tag:
+        description: 'Release tag to submit (e.g. v0.73.1)'
+        required: true
+        type: string
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: vedantmgoyal2009/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e # v2
+        with:
+          identifier: junegunn.fzf
+          release-tag: ${{ inputs.release-tag || github.event.release.tag_name }}
+          installers-regex: '-windows_(armv7|arm64|amd64)\.zip$'
+          token: ${{ secrets.WINGET_TOKEN }}