From e12791225dd87a187cc6d2c072e8a397f194e08c Mon Sep 17 00:00:00 2001
From: Jan Dubois <jan.dubois@suse.com>
Date: Sun, 19 Apr 2026 20:49:26 -0700
Subject: [PATCH] Update nobin config with base64 and confusables checking

* Move the flags from the Makefile to .nobin.yaml
* Check for unexpected base64 data of 32 characters or more
* Check for Unicode characters that can be confused with Latin letters
  or digits
* Run nobin in lint-quick.yml instead of test.yml

test.yml skips docs-only changes, but docs are a likely place for a
link spelled with a look-alike letter. lint-quick.yml runs on every
change.

Both checks rely on heuristics and skip some candidates to avoid false
positives. The config file lists the known exceptions.

Signed-off-by: Jan Dubois <jan.dubois@suse.com>
---
 .github/workflows/lint-quick.yml |  2 ++
 .github/workflows/test.yml       |  2 --
 .nobin.yaml                      | 37 ++++++++++++++++++++++++++++++++
 Makefile                         |  2 +-
 4 files changed, 40 insertions(+), 3 deletions(-)
 create mode 100644 .nobin.yaml

diff --git a/.github/workflows/lint-quick.yml b/.github/workflows/lint-quick.yml
index 100a2fba..804a2e0f 100644
--- a/.github/workflows/lint-quick.yml
+++ b/.github/workflows/lint-quick.yml
@@ -25,6 +25,8 @@ jobs:
       with:
         go-version: stable
         cache: false
+    - name: Run nobin
+      run: make nobin
     - name: Run editorconfig-checker
       run: make editorconfig-checker
     - name: Run yamllint
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c9d44dc0..a35200ac 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -41,8 +41,6 @@ jobs:
         make install-protoc-tools
     - name: Verify generated files
       run: make generate check-generated
-    - name: Run nobin
-      run: make nobin
     - name: Install shellcheck
       run: |
         sudo apt-get update
diff --git a/.nobin.yaml b/.nobin.yaml
new file mode 100644
index 00000000..afa21db7
--- /dev/null
+++ b/.nobin.yaml
@@ -0,0 +1,37 @@
+# nobin configuration file, used by `make nobin`.
+# nobin checks the repository for binary files, invisible and control
+# characters, long base64 strings, and non-ASCII characters that look
+# like Latin letters or digits. This file selects the checks and lists
+# the files exempt from them.
+# https://github.com/jandubois/nobin
+all: false
+gitignore: true
+skip:
+- docs/reports/**/*.pdf
+- pkg/**/*.pb.desc
+- website/static/images/**/*.{gif,png}
+skip-ext: []
+
+# Allowed characters
+allow: []
+allow-bell: false
+allow-bom: false
+allow-emoji: true
+allow-escape: true
+
+# Additional checks (opt-in)
+block-base64: 32          # 0 = disabled, N = minimum run length
+skip-base64:
+- go.sum
+- package-lock.json
+- hack/bats/lib/**/*.gpg
+- pkg/limatmpl/embed_test.go
+- pkg/sshutil/sshutil_test.go
+
+block-confusables: alphanum   # "" = disabled, "alphanum" / "url" / "strict"
+skip-confusables: []
+
+# Output
+quiet: false
+verbose: false
+hide-skipped: false
diff --git a/Makefile b/Makefile
index 28519e0b..4b73e21c 100644
--- a/Makefile
+++ b/Makefile
@@ -654,7 +654,7 @@ bats: native limactl-plugins
 # Linting targets - individual stages
 .PHONY: nobin
 nobin:
-	$(GO) run -modfile=./hack/tools/go.mod github.com/jandubois/nobin --allow-emoji --allow-escape --gitignore --skip-ext pb.desc --skip 'website/static/images/**/*.{gif,png}' --skip 'docs/reports/**/*.pdf'
+	$(GO) run -modfile=./hack/tools/go.mod github.com/jandubois/nobin
 
 .PHONY: editorconfig-checker
 editorconfig-checker: