chore(dmg): remove shell script

.github/workflows/release.yml

@@ -131,8 +131,6 @@ jobs:
             "dist/stepsecurity-dev-machine-guard-windows_amd64.exe.bundle"
           sign_with_retry "${{ steps.binaries.outputs.win_arm64 }}" \
             "dist/stepsecurity-dev-machine-guard-windows_arm64.exe.bundle"
-          sign_with_retry "stepsecurity-dev-machine-guard.sh" \
-            "dist/stepsecurity-dev-machine-guard.sh.bundle"
       - name: Upload cosign bundles
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -141,7 +139,6 @@ jobs:
             dist/stepsecurity-dev-machine-guard-darwin_unnotarized.bundle \
             dist/stepsecurity-dev-machine-guard-windows_amd64.exe.bundle \
             dist/stepsecurity-dev-machine-guard-windows_arm64.exe.bundle \
-            dist/stepsecurity-dev-machine-guard.sh.bundle \
             --clobber
 
       - name: Attest build provenance
@@ -151,4 +148,3 @@ jobs:
             ${{ steps.binaries.outputs.darwin }}
             ${{ steps.binaries.outputs.win_amd64 }}
             ${{ steps.binaries.outputs.win_arm64 }}
-            stepsecurity-dev-machine-guard.sh

.goreleaser.yml

@@ -45,5 +45,3 @@ archives:
 
 release:
   draft: true
-  extra_files:
-    - glob: stepsecurity-dev-machine-guard.sh

docs/release-process.md

@@ -87,8 +87,6 @@ Each release includes:
 | `stepsecurity-dev-machine-guard-VERSION-darwin` | Notarized universal macOS binary (amd64 + arm64) |
 | `stepsecurity-dev-machine-guard-VERSION-darwin_unnotarized` | Original CI-built binary (for provenance verification) |
 | `stepsecurity-dev-machine-guard-VERSION-darwin_unnotarized.bundle` | Sigstore cosign bundle for the unnotarized binary |
-| `stepsecurity-dev-machine-guard.sh` | Legacy shell script |
-| `stepsecurity-dev-machine-guard.sh.bundle` | Sigstore cosign bundle for the shell script |
 
 ---
 

internal/executor/executor_unix.go

@@ -19,7 +19,7 @@ func (r *Real) IsRoot() bool {
 // the lookup fails, or if the resolved path isn't an executable file — in which
 // case callers should fall back to /bin/bash.
 //
-// Mirrors stepsecurity-dev-machine-guard.sh:run_as_logged_in_user. Matters when
+// Matters when
 // the user's PATH (including npm/pnpm/yarn via nvm/fnm/homebrew) is configured
 // only in zsh profile files (.zprofile/.zshrc) — bash -l on such a user sources
 // nothing and runs with a stripped PATH, producing empty package scans.