chore(changelog): update changelog for v0.5.1

- Replaces custom release and changelog logic with auto-changelog action
- Reduces complexity and maintenance effort in the release process
- Ensures consistent changelog generation and release creation

.gitea/workflows/release.yml

@@ -7,217 +7,13 @@ on:
       - "**"
 
 jobs:
-  detect-version-change:
-    runs-on: ubuntu-latest
-    outputs:
-      version_changed: ${{ steps.set.outputs.version_changed }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Check if VERSION file changed
-        if: github.ref == 'refs/heads/main'
-        run: |
-          echo "🔍 Vergleich mit github.event.before:"
-          echo "Before: ${{ github.event.before }}"
-          echo "After:  ${{ github.sha }}"
-
-          echo "📄 Changed files between before and after:"
-          git diff --name-only ${{ github.event.before }} ${{ github.sha }} || echo "(diff failed)"
-
-          if git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -q '^VERSION$'; then
-            echo "✅ VERSION file was changed"
-            echo "VERSION_CHANGED=true" >> $GITHUB_ENV
-          else
-            echo "ℹ️ VERSION file not changed"
-            echo "VERSION_CHANGED=false" >> $GITHUB_ENV
-          fi
-
-      - name: Set output (always)
-        id: set
-        run: |
-          echo "version_changed=${VERSION_CHANGED:-false}" >> $GITHUB_OUTPUT
-
-  changelog-only:
-    needs: detect-version-change
-    if: github.ref != 'refs/heads/main' || needs.detect-version-change.outputs.version_changed == 'false'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Set Git Author
-        run: |
-          git config user.name "$CI_COMMIT_AUTHOR_NAME"
-          git config user.email "$CI_COMMIT_AUTHOR_EMAIL"
-
-      - name: Read CLIFF_VERSION from cliff.toml
-        id: cliff_version
-        run: |
-          echo "version=$(awk -F '=' '/^# CLIFF_VERSION=/ { gsub(/[" ]/, "", $2); print $2 }' cliff.toml)" >> $GITHUB_OUTPUT
-
-      - name: Restore git-cliff cache
-        id: restore-cliff
-        uses: https://git.0xmax42.io/actions/cache@v1
-        with:
-          key: cargo-cliff-${{ steps.cliff_version.outputs.version }}
-          paths: |
-            /root/.cargo/bin
-
-      - name: Install git-cliff
-        if: steps.restore-cliff.outputs.cache-hit != 'true'
-        run: |
-          cargo install git-cliff --version "${{ steps.cliff_version.outputs.version }}" --features gitea
-
-      - name: Generate unreleased changelog (if file exists or on main)
-        run: |
-          if [[ -f CHANGELOG.md || "${GITHUB_REF##refs/heads/}" == "main" ]]; then
-            echo "Generating CHANGELOG.md..."
-            git-cliff -c cliff.toml -o CHANGELOG.md
-          else
-            echo "CHANGELOG.md does not exist and this is not 'main'. Skipping generation."
-          fi
-
-      - name: Commit updated CHANGELOG
-        run: |
-          git add CHANGELOG.md
-          if git diff --cached --quiet; then
-            echo "No changes to commit"
-          else
-            git commit -m "chore(changelog): update unreleased changelog"
-            git push origin "${GITHUB_REF##refs/heads/}"
-          fi
-
   release:
-    needs: detect-version-change
-    if: needs.detect-version-change.outputs.version_changed == 'true' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-
+      - name: Release
-      - name: Set Git Author
+        uses: https://git.0xmax42.io/actions/auto-changelog-release-action@v0
-        run: |
-          git config user.name "$CI_COMMIT_AUTHOR_NAME"
-          git config user.email "$CI_COMMIT_AUTHOR_EMAIL"
-
-      - name: Read VERSION
-        id: version
-        run: echo "value=$(cat VERSION)" >> $GITHUB_OUTPUT
-
-      - name: Read CLIFF_VERSION from cliff.toml
-        id: cliff_version
-        run: |
-          echo "version=$(awk -F '=' '/^# CLIFF_VERSION=/ { gsub(/[" ]/, "", $2); print $2 }' cliff.toml)" >> $GITHUB_OUTPUT
-
-      - name: Restore git-cliff cache
-        id: restore-cliff
-        uses: https://git.0xmax42.io/actions/cache@v1
         with:
-          key: cargo-cliff-${{ steps.cliff_version.outputs.version }}
+          token: ${{ secrets.RELEASE_PUBLISH_TOKEN }}
-          paths: |
-            /root/.cargo/bin
-
-      - name: Install git-cliff
-        if: steps.restore-cliff.outputs.cache-hit != 'true'
-        run: |
-          cargo install git-cliff --version "${{ steps.cliff_version.outputs.version }}" --features gitea
-
-      - name: Generate changelog for release and tag
-        id: generate-changelog
-        run: |
-          VERSION=${{ steps.version.outputs.value }}
-          git-cliff -c cliff.toml -t "v$VERSION" -o CHANGELOG.md
-
-          BODY=$(mktemp)
-          ESCAPED_VERSION=$(echo "$VERSION" | sed 's/\./\\./g')
-
-          awk -v ver="$ESCAPED_VERSION" '
-            $0 ~ "^## \\[" ver "\\]" {
-              print_flag=1
-              line = $0
-              sub(/^## /, "", line)
-              sub(/\\s*\\(.*\\)/, "", line)  # entfernt z. B. "(...)" oder "(*)"
-              print line
-              next
-            }
-            $0 ~ "^## \\[" && $0 !~ "^## \\[" ver "\\]" {
-              print_flag=0
-            }
-            print_flag
-          ' CHANGELOG.md > "$BODY"
-
-          echo "changelog_body_path=$BODY" >> $GITHUB_OUTPUT
-
-      - name: Commit updated CHANGELOG
-        run: |
-          git add CHANGELOG.md
-          if git diff --cached --quiet; then
-            echo "No changes to commit"
-          else
-            git commit -m "chore(changelog): update changelog for v${{ steps.version.outputs.value }}"
-            git push origin main
-          fi
-
-      - name: Create Git tag (if not exists)
-        run: |
-          VERSION=${{ steps.version.outputs.value }}
-          if git rev-parse "v$VERSION" >/dev/null 2>&1; then
-            echo "Tag v$VERSION already exists, skipping tag creation."
-          else
-            export GIT_AUTHOR_DATE="$(date --iso-8601=seconds)"
-            export GIT_COMMITTER_DATE="$GIT_AUTHOR_DATE"
-            git tag -a "v$VERSION" -F "${{ steps.generate-changelog.outputs.changelog_body_path }}" --cleanup=verbatim
-            git push origin "v$VERSION"
-          fi
-
-      - name: Create Gitea release
-        env:
-          RELEASE_PUBLISH_TOKEN: ${{ secrets.RELEASE_PUBLISH_TOKEN }}
-        run: |
-          VERSION=${{ steps.version.outputs.value }}
-          BODY_FILE="${{ steps.generate-changelog.outputs.changelog_body_path }}"
-
-          OWNER=$(echo "$GITHUB_REPOSITORY" | cut -d/ -f1)
-          REPO=$(echo "$GITHUB_REPOSITORY" | cut -d/ -f2)
-
-          # Token-Auswahl
-          TOKEN="${RELEASE_PUBLISH_TOKEN:-$ACTIONS_RUNTIME_TOKEN}"
-
-          if [[ -z "${RELEASE_PUBLISH_TOKEN:-}" ]]; then
-            echo "::warning title=Limited Release Propagation::"
-            echo "RELEASE_PUBLISH_TOKEN is not set. Using ACTIONS_RUNTIME_TOKEN instead."
-            echo "⚠️  Release events may not trigger other workflows if created with the runtime token."
-            echo
-          fi
-
-          # Prüfe, ob der Release schon existiert
-          if curl -sf "$GITHUB_API_URL/repos/$OWNER/$REPO/releases/tags/v$VERSION" \
-            -H "Authorization: token $TOKEN" > /dev/null; then
-            echo "🔁 Release for tag v$VERSION already exists, skipping."
-            exit 0
-          fi
-
-          echo "🚀 Creating Gitea release for v$VERSION"
-
-          # Release-Beschreibung vorbereiten
-          RELEASE_BODY=$(tail -n +2 "$BODY_FILE" | jq -Rs .)
-
-          curl -X POST "$GITHUB_API_URL/repos/$OWNER/$REPO/releases" \
-            -H "Authorization: token $TOKEN" \
-            -H "Content-Type: application/json" \
-            -d @- <<EOF
-          {
-            "tag_name": "v$VERSION",
-            "target_commitish": "main",
-            "name": "Release v$VERSION",
-            "body": $RELEASE_BODY,
-            "draft": false,
-            "prerelease": false
-          }
-          EOF
-
-          echo "✅ Release for tag $VERSION created successfully."

.gitea/workflows/upload-assets.yml

@@ -43,6 +43,22 @@ jobs:
       - name: Upload SHA256 for ${{ matrix.target }}-${{ matrix.arch }}
         run: .gitea/scripts/upload-asset.sh ./dist/systemd-timer-${{ matrix.target }}-${{ matrix.arch }}.sha256 systemd-timer-${{ matrix.target }}-${{ matrix.arch }}.sha256
 
+      - name: Create zstd compressed archive
+        run: |
+          FILE="./dist/systemd-timer-${{ matrix.target }}-${{ matrix.arch }}"
+          zstd -q -19 -T0 -f "$FILE" -o "$FILE.zst"
+
+      - name: Generate SHA256 for zstd compressed archive
+        run: |
+          FILE="./dist/systemd-timer-${{ matrix.target }}-${{ matrix.arch }}.zst"
+          sha256sum "$FILE" > "$FILE.sha256"
+
+      - name: Upload zstd compressed archive for ${{ matrix.target }}-${{ matrix.arch }}
+        run: .gitea/scripts/upload-asset.sh ./dist/systemd-timer-${{ matrix.target }}-${{ matrix.arch }}.zst systemd-timer-${{ matrix.target }}-${{ matrix.arch }}.zst
+
+      - name: Upload SHA256 for zstd compressed archive
+        run: .gitea/scripts/upload-asset.sh ./dist/systemd-timer-${{ matrix.target }}-${{ matrix.arch }}.zst.sha256 systemd-timer-${{ matrix.target }}-${{ matrix.arch }}.zst.sha256
+
       - name: Run Releases Sync Action
         uses: https://git.0xmax42.io/actions/releases-sync@main
         with:

CHANGELOG.md

@@ -2,14 +2,38 @@
 
 All notable changes to this project will be documented in this file.
 
-## [unreleased]
+## [0.5.1](https://git.0xmax42.io/maxp/systemd-timer/compare/v0.5.0..v0.5.1) - 2025-06-15
 
 ### 🚀 Features
 
+- *(install)* Add support for compressed .zst archives - ([3a1ee0c](https://git.0xmax42.io/maxp/systemd-timer/commit/3a1ee0cfd6ddba8734cde09196803e9ccdd14c5f))
+- *(workflows)* Add zstd compression for build artifacts - ([d9183d2](https://git.0xmax42.io/maxp/systemd-timer/commit/d9183d2f04b03cbdaf9e11bf05f7ce66111123e5))
+
+### 📚 Documentation
+
+- *(readme)* Add input validation and multilingual support - ([ce78cf3](https://git.0xmax42.io/maxp/systemd-timer/commit/ce78cf3a9a14028114e0fb6fcc0973d86c2b2227))
+
+### ⚙️ Miscellaneous Tasks
+
+- *(workflows)* Simplify release workflow with auto-changelog - ([05f3b51](https://git.0xmax42.io/maxp/systemd-timer/commit/05f3b519f56d893a0135736d8b722302c7cdd3f6))
+- *(workflows)* Add locked flag to cargo install for git-cliff - ([6efc151](https://git.0xmax42.io/maxp/systemd-timer/commit/6efc1515ed4f4fb8802405529e4a6e04870ec02a))
+
+## [0.5.0](https://git.0xmax42.io/maxp/systemd-timer/compare/v0.4.1..v0.5.0) - 2025-05-30
+
+### 🚀 Features
+
+- *(cli)* Add validation for command options - ([1c07af4](https://git.0xmax42.io/maxp/systemd-timer/commit/1c07af402b35ba4c2abf89ff5816e791994db536))
+- *(validation)* Add CLI validation helpers for input checks - ([3d95706](https://git.0xmax42.io/maxp/systemd-timer/commit/3d95706d683cac8d279dfb718541a17c42fa5d71))
+- *(build)* Add run permissions to compiled binaries - ([ccb04e4](https://git.0xmax42.io/maxp/systemd-timer/commit/ccb04e49820ff8238d7e7ad853aab5db06d5dc8a))
+- *(ci)* Add compile steps to CI workflow - ([531a02a](https://git.0xmax42.io/maxp/systemd-timer/commit/531a02a6e11a769f2e05888d49ea2b4808d974e3))
 - *(vscode)* Add JSONC formatter configuration - ([c7af1fb](https://git.0xmax42.io/maxp/systemd-timer/commit/c7af1fb6caa46c22b84229745067d05bf60b6f64))
 - *(i18n)* Support loading JSONC translation files - ([4ac5dd4](https://git.0xmax42.io/maxp/systemd-timer/commit/4ac5dd4c88324f99cb6827283ad85bb9718abbeb))
 - *(config)* Add @std/jsonc dependency - ([8f1cb3f](https://git.0xmax42.io/maxp/systemd-timer/commit/8f1cb3fad71ead365d93087963ddb6c7202a9b4f))
 
+### 🐛 Bug Fixes
+
+- *(build)* Update included files to use .jsonc format - ([f3f2c61](https://git.0xmax42.io/maxp/systemd-timer/commit/f3f2c61da0785dce4c6b8c7d8ef0ae9abf098172))
+
 ### 🎨 Styling
 
 - *(i18n)* Add comments for clarity and rename files - ([5226269](https://git.0xmax42.io/maxp/systemd-timer/commit/5226269ec2a0b76dfa30ac8d614c3789ff3a837b))
@@ -19,6 +43,10 @@ All notable changes to this project will be documented in this file.
 - *(fs)* Update test descriptions and comments to English - ([c4f4614](https://git.0xmax42.io/maxp/systemd-timer/commit/c4f4614a2daee68f9b33b9676106214c65a1a427))
 - *(fs)* Add rollback tests for writeUnitFiles errors - ([6039d23](https://git.0xmax42.io/maxp/systemd-timer/commit/6039d236eb7de449ce22b1d9ea718389a3e2261d))
 
+### ⚙️ Miscellaneous Tasks
+
+- *(lock)* Update dependencies to latest versions - ([28b23cf](https://git.0xmax42.io/maxp/systemd-timer/commit/28b23cf947ecc57eb7fde541b29c68b41e508e7d))
+
 ## [0.4.1](https://git.0xmax42.io/maxp/systemd-timer/compare/v0.4.0..v0.4.1) - 2025-05-28
 
 ### 🐛 Bug Fixes

README.DE.md

@@ -23,6 +23,9 @@ Ein einfaches CLI-Tool zum schnellen Erzeugen von systemd `.service` und `.timer
   - `--cwd`: Arbeitsverzeichnis des Prozesses (`WorkingDirectory`)
   - `--dry-run`: Gibt nur die generierten Inhalte aus, ohne sie zu schreiben
 - Getestet und typisiert mit **Deno** + **Cliffy**
+- Eingaben werden validiert und auf Fehler geprüft;
+  - z.B. muss `--calendar` ein gültiger systemd `OnCalendar` Ausdruck sein
+- Mehrsprachig (Englisch, Deutsch)
 
 ---
 

README.md

@@ -24,6 +24,9 @@ A simple CLI tool for quickly generating systemd `.service` and `.timer` units
   * `--cwd`: Working directory for the process (`WorkingDirectory`)
   * `--dry-run`: Outputs unit content without writing to disk
 * Tested and fully typed with **Deno** + **Cliffy**
+* Inputs are validated and checked for errors;
+  * e.g., `--calendar` must be a valid systemd `OnCalendar` expression
+* Multilingual (English, German)
 
 ---
 

VERSION

@@ -1 +1 @@
-0.4.1
+0.5.1

deno.jsonc

@@ -5,8 +5,8 @@
         "fmt": "deno fmt --check",
         "lint": "deno lint",
         "ci": "deno task fmt && deno task lint && deno task test && build:amd64", // For local CI checks
-        "build:amd64": "deno compile --target x86_64-unknown-linux-gnu --include VERSION --include src/i18n/de.jsonc --include src/i18n/en.jsonc --allow-env --allow-write --allow-read --output dist/systemd-timer-linux-amd64 src/mod.ts",
+        "build:amd64": "deno compile --target x86_64-unknown-linux-gnu --include VERSION --include src/i18n/de.jsonc --include src/i18n/en.jsonc --allow-env --allow-write --allow-read --allow-run --output dist/systemd-timer-linux-amd64 src/mod.ts",
-        "build:arm64": "deno compile --target aarch64-unknown-linux-gnu --include VERSION --include src/i18n/de.jsonc --include src/i18n/en.jsonc --allow-env --allow-write --allow-read --output dist/systemd-timer-linux-arm64 src/mod.ts"
+        "build:arm64": "deno compile --target aarch64-unknown-linux-gnu --include VERSION --include src/i18n/de.jsonc --include src/i18n/en.jsonc --allow-env --allow-write --allow-read --allow-run --output dist/systemd-timer-linux-arm64 src/mod.ts"
     },
     "compilerOptions": {},
     "fmt": {

deno.lock

@@ -53,6 +53,10 @@
     }
   },
   "remote": {
+    "https://deno.land/std@0.192.0/fmt/colors.ts": "d67e3cd9f472535241a8e410d33423980bec45047e343577554d3356e1f0ef4e",
+    "https://deno.land/std@0.192.0/testing/_diff.ts": "1a3c044aedf77647d6cac86b798c6417603361b66b54c53331b312caeb447aea",
+    "https://deno.land/std@0.192.0/testing/_format.ts": "a69126e8a469009adf4cf2a50af889aca364c349797e63174884a52ff75cf4c7",
+    "https://deno.land/std@0.192.0/testing/asserts.ts": "e16d98b4d73ffc4ed498d717307a12500ae4f2cbe668f1a215632d19fcffc22f",
     "https://deno.land/std@0.224.0/assert/_constants.ts": "a271e8ef5a573f1df8e822a6eb9d09df064ad66a4390f21b3e31f820a38e0975",
     "https://deno.land/std@0.224.0/assert/assert.ts": "09d30564c09de846855b7b071e62b5974b001bb72a4b797958fe0660e7849834",
     "https://deno.land/std@0.224.0/assert/assert_almost_equals.ts": "9e416114322012c9a21fa68e187637ce2d7df25bcbdbfd957cd639e65d3cf293",

scripts/install.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-# Fail-safe bash mode (only if bash is used)
+# Fail-safe bash mode
 if [ -n "$BASH_VERSION" ]; then
   set -euo pipefail
 else
@@ -26,23 +26,54 @@ case "$OS" in
   *) echo "Unsupported OS: $OS" >&2; exit 1 ;;
 esac
 
-# === Download-URL zusammensetzen ===
+# === Datei- und URL-Namen ===
-BINARY_FILE="${BINARY_NAME}-${OS}-${ARCH}"
+BASE_NAME="${BINARY_NAME}-${OS}-${ARCH}"
-DOWNLOAD_URL="${REPO_URL}/${BINARY_FILE}"
+ZST_NAME="${BASE_NAME}.zst"
+ZST_URL="${REPO_URL}/${ZST_NAME}"
+BIN_URL="${REPO_URL}/${BASE_NAME}"
 
 echo "📦 Installing ${BINARY_NAME} for ${OS}/${ARCH}..."
-echo "🌐 Downloading from: ${DOWNLOAD_URL}"
 
-# === Binary herunterladen ===
+USE_ZSTD=false
-TMP_FILE=$(mktemp)
+if command -v zstd >/dev/null; then
-curl -fsSL "${DOWNLOAD_URL}" -o "${TMP_FILE}"
+  echo "✅ 'zstd' found – will use compressed .zst archive"
-chmod +x "${TMP_FILE}"
+  USE_ZSTD=true
+fi
 
-# === SHA256-Check ===
+TMP_DIR=$(mktemp -d)
-TMP_HASH=$(mktemp)
+cleanup() {
-curl -fsSL "${DOWNLOAD_URL}.sha256" -o "$TMP_HASH"
+  rm -rf "$TMP_DIR"
-EXPECTED_HASH=$(cut -d ' ' -f1 "$TMP_HASH")
+}
-ACTUAL_HASH=$(openssl dgst -sha256 "$TMP_FILE" | awk '{print $2}')
+trap cleanup EXIT
+
+if [ "$USE_ZSTD" = true ]; then
+  echo "🌐 Downloading: ${ZST_URL}"
+  curl -fsSL "$ZST_URL" -o "$TMP_DIR/${ZST_NAME}"
+  echo "🌐 Downloading checksum: ${ZST_URL}.sha256"
+  curl -fsSL "$ZST_URL.sha256" -o "$TMP_DIR/zst.sha256"
+
+  EXPECTED_HASH=$(cut -d ' ' -f1 "$TMP_DIR/zst.sha256")
+  ACTUAL_HASH=$(openssl dgst -sha256 "$TMP_DIR/${ZST_NAME}" | awk '{print $2}')
+
+  if [ "$EXPECTED_HASH" != "$ACTUAL_HASH" ]; then
+    echo "⚠️ Checksum mismatch for .zst archive!"
+    echo "Expected: $EXPECTED_HASH"
+    echo "Actual:   $ACTUAL_HASH"
+    exit 1
+  fi
+
+  echo "📥 Decompressing..."
+  zstd -d -q "$TMP_DIR/${ZST_NAME}" -o "$TMP_DIR/${BASE_NAME}"
+  TMP_FILE="$TMP_DIR/${BASE_NAME}"
+
+else
+  echo "🌐 Downloading uncompressed binary: ${BIN_URL}"
+  curl -fsSL "$BIN_URL" -o "$TMP_DIR/${BASE_NAME}"
+  echo "🌐 Downloading checksum: ${BIN_URL}.sha256"
+  curl -fsSL "$BIN_URL.sha256" -o "$TMP_DIR/binary.sha256"
+
+  EXPECTED_HASH=$(cut -d ' ' -f1 "$TMP_DIR/binary.sha256")
+  ACTUAL_HASH=$(openssl dgst -sha256 "$TMP_DIR/${BASE_NAME}" | awk '{print $2}')
 
   if [ "$EXPECTED_HASH" != "$ACTUAL_HASH" ]; then
     echo "⚠️ Checksum mismatch!"
@@ -51,12 +82,15 @@ if [ "$EXPECTED_HASH" != "$ACTUAL_HASH" ]; then
     exit 1
   fi
 
-# === Installation ===
+  TMP_FILE="$TMP_DIR/${BASE_NAME}"
+fi
+
+chmod +x "$TMP_FILE"
 echo "🚀 Installing to ${INSTALL_PATH}/${BINARY_NAME}"
 if [ -w "$INSTALL_PATH" ]; then
-  install -m 755 "${TMP_FILE}" "${INSTALL_PATH}/${BINARY_NAME}"
+  install -m 755 "$TMP_FILE" "${INSTALL_PATH}/${BINARY_NAME}"
 else
-  sudo install -m 755 "${TMP_FILE}" "${INSTALL_PATH}/${BINARY_NAME}"
+  sudo install -m 755 "$TMP_FILE" "${INSTALL_PATH}/${BINARY_NAME}"
 fi
 
 echo "✅ Installation complete: $(command -v ${BINARY_NAME})"

src/cli/create.ts

@@ -2,6 +2,14 @@ import { Command } from '@cliffy/command';
 import { generateUnitFiles } from '../templates/unit-generator.ts';
 import { TimerOptions } from '../types/options.ts';
 import { t } from '../i18n/mod.ts';
+import {
+    collectAndValidateAfter,
+    collectAndValidateEnv,
+    validateIdentifier,
+    validateNotEmpty,
+    validatePath,
+    validateSystemdCalendar,
+} from '../utils/mod.ts';
 
 export function createCommand() {
     return new Command()
@@ -9,43 +17,54 @@ export function createCommand() {
         .option(
             '--name <name:string>',
             t('option_name'),
+            { value: (v) => validateIdentifier(v, '--name') },
         )
         .option(
             '--exec <cmd:string>',
             t('option_exec'),
-            { required: true },
+            {
+                required: true,
+                value: (v) => validateNotEmpty(v, '--exec'),
+            },
         )
         .option('--calendar <time:string>', t('option_calendar'), {
             required: true,
+            value: validateSystemdCalendar,
         })
         .option('--description <desc:string>', t('option_description'))
         .option('--user', t('option_user'))
         .option(
             '--run-as <user:string>',
             t('option_run_as'),
+            { value: (v) => validateNotEmpty(v, '--run-as') },
         )
         .option(
             '--home <path:string>',
             t('option_home'),
+            { value: (v) => validatePath(v, true) },
         )
         .option(
             '--cwd <path:string>',
             t('option_cwd'),
+            { value: (v) => validatePath(v, true) },
         )
-        .option('--output <dir:string>', t('option_output'))
+        .option('--output <dir:string>', t('option_output'), {
+            value: (v) => validatePath(v, false),
+        })
         .option(
             '--after <target:string>',
             t('option_after'),
-            { collect: true },
+            { collect: true, value: collectAndValidateAfter },
         )
         .option(
             '--environment <env:string>',
             t('option_environment'),
-            { collect: true },
+            { collect: true, value: collectAndValidateEnv },
         )
         .option(
             '--logfile <file:string>',
             t('option_logfile'),
+            { value: (v) => validatePath(v, false) },
         )
         .option('--dry-run', t('option_dry_run'))
         .action(async (options: TimerOptions) => {

src/i18n/de.jsonc

@@ -22,5 +22,11 @@
     "hint_header": "\nℹ️  Hinweis:",
     // Error messages
     "error_write_units": "Fehler beim Schreiben der Units:",
-    "rollback_failed": "Rollback fehlgeschlagen:"
+    "rollback_failed": "Rollback fehlgeschlagen:",
+    "error_invalid_env": "Ungültiges Environment-Format. Verwende KEY=VALUE.",
+    "error_path_schold_not_be_empty": "Pfad darf nicht leer sein.",
+    "error_path_not_found": "Pfad nicht gefunden: {path}",
+    "error_value_should_not_be_empty": "Wert ({label}) sollte nicht leer sein.",
+    "error_invalid_identifier": "Ungültiger Bezeichner: '{value}' für {identifier}. Erlaubt sind nur alphanumerische Zeichen, Unterstriche und Bindestriche.",
+    "error_invalid_calendar": "Ungültiger OnCalendar-Ausdruck: {value}. Bitte überprüfe die Syntax."
 }

src/i18n/en.jsonc

@@ -22,5 +22,11 @@
     "hint_header": "\nℹ️  Note:",
     // Error messages
     "error_write_units": "Error while writing unit files:",
-    "rollback_failed": "Rollback failed:"
+    "rollback_failed": "Rollback failed:",
+    "error_invalid_env": "Invalid environment format. Use KEY=VALUE.",
+    "error_path_schold_not_be_empty": "Path should not be empty.",
+    "error_path_not_found": "Path not found: {path}",
+    "error_value_should_not_be_empty": "Value ({label}) should not be empty.",
+    "error_invalid_identifier": "Invalid identifier: '{value}' for {identifier}. Only alphanumeric characters, underscores, and hyphens are allowed.",
+    "error_invalid_calendar": "Invalid OnCalendar expression: {value}. Please check the syntax."
 }

src/utils/__tests__/cliValidationHelper.test.ts

@@ -0,0 +1,145 @@
+import { resolve } from 'https://deno.land/std@0.224.0/path/mod.ts';
+import { ValidationError } from '@cliffy/command';
+import {
+    collectAndValidateAfter,
+    collectAndValidateEnv,
+    validateIdentifier,
+    validateNotEmpty,
+    validatePath,
+    validateSystemdCalendar,
+} from '../mod.ts';
+import { t } from '../../i18n/mod.ts';
+import {
+    assertEquals,
+    assertThrows,
+} from 'https://deno.land/std@0.224.0/assert/mod.ts';
+
+Deno.test(
+    'collectAndValidateEnv: throws ValidationError for invalid env format',
+    () => {
+        const invalidEnv = 'INVALID_ENV';
+        assertThrows(
+            () => collectAndValidateEnv(invalidEnv),
+            ValidationError,
+            t('error_invalid_env', { value: invalidEnv }),
+        );
+    },
+);
+
+Deno.test(
+    'collectAndValidateEnv: returns collected array for valid env format',
+    () => {
+        const validEnv = 'KEY=value';
+        const previous = ['EXISTING=env'];
+        const result = collectAndValidateEnv(validEnv, previous);
+        assertEquals(result, ['EXISTING=env', 'KEY=value']);
+    },
+);
+
+Deno.test('collectAndValidateEnv: aggregates multiple calls', () => {
+    const first = collectAndValidateEnv('FOO=bar');
+    const second = collectAndValidateEnv('BAZ=qux', first);
+    assertEquals(second, ['FOO=bar', 'BAZ=qux']);
+});
+
+Deno.test(
+    'validatePath: returns absolute path for valid path without existence check',
+    () => {
+        const tmpDir = Deno.makeTempDirSync();
+        const relativePath = `${tmpDir}/testfile.txt`;
+        const result = validatePath(relativePath, false);
+        assertEquals(result, resolve(relativePath));
+    },
+);
+
+Deno.test(
+    'validatePath: throws ValidationError for non‑existent path with existence check',
+    () => {
+        const tmpDir = Deno.makeTempDirSync();
+        const nonExistentPath = `${tmpDir}/nonexistent.txt`;
+        assertThrows(
+            () => validatePath(nonExistentPath, true),
+            ValidationError,
+            t('error_path_not_found', { path: resolve(nonExistentPath) }),
+        );
+    },
+);
+
+Deno.test(
+    'validatePath: returns absolute path for existing path with existence check',
+    () => {
+        const tmpDir = Deno.makeTempDirSync();
+        const existingPath = `${tmpDir}/existing.txt`;
+        Deno.writeTextFileSync(existingPath, 'test content');
+        const result = validatePath(existingPath, true);
+        assertEquals(result, resolve(existingPath));
+    },
+);
+
+Deno.test('validatePath: throws ValidationError for empty path', () => {
+    const invalidPath = '';
+    assertThrows(
+        () => validatePath(invalidPath, true),
+        ValidationError,
+        t('error_path_schold_not_be_empty'),
+    );
+});
+
+Deno.test('validateNotEmpty: returns value for non‑empty string', () => {
+    const input = 'some-value';
+    const result = validateNotEmpty(input, '--exec');
+    assertEquals(result, input);
+});
+
+Deno.test('validateNotEmpty: throws ValidationError for empty string', () => {
+    const input = '';
+    assertThrows(
+        () => validateNotEmpty(input, '--exec'),
+        ValidationError,
+        t('error_value_should_not_be_empty', { label: '--exec' }),
+    );
+});
+
+Deno.test('collectAndValidateAfter: returns aggregated array', () => {
+    const first = collectAndValidateAfter('network.target');
+    const second = collectAndValidateAfter('postgres.service', first);
+    assertEquals(second, ['network.target', 'postgres.service']);
+});
+
+Deno.test('collectAndValidateAfter: throws ValidationError for empty value', () => {
+    assertThrows(
+        () => collectAndValidateAfter(''),
+        ValidationError,
+        t('error_value_should_not_be_empty', { label: '--after' }),
+    );
+});
+
+Deno.test('validateIdentifier: returns value for valid identifier', () => {
+    const id = 'backup_job-1';
+    const result = validateIdentifier(id, '--name');
+    assertEquals(result, id);
+});
+
+Deno.test('validateIdentifier: throws ValidationError for invalid identifier', () => {
+    const id = 'invalid$';
+    assertThrows(
+        () => validateIdentifier(id, '--name'),
+        ValidationError,
+        t('error_invalid_identifier', { label: '--name', value: id }),
+    );
+});
+
+Deno.test('validateSystemdCalendar: accepts valid expression', async () => {
+    const valid = 'Mon..Fri 12:00';
+    const result = await validateSystemdCalendar(valid);
+    assertEquals(result, valid);
+});
+
+Deno.test('validateSystemdCalendar: rejects invalid expression', async () => {
+    const invalid = 'Mo..Fr 12:00';
+    await assertThrows(
+        () => validateSystemdCalendar(invalid),
+        ValidationError,
+        t('error_invalid_calendar', { value: invalid }),
+    );
+});

src/utils/cliValidationHelper.ts

@@ -0,0 +1,176 @@
+import { ValidationError } from '@cliffy/command';
+import { t } from '../i18n/mod.ts';
+import { existsSync } from 'https://deno.land/std@0.224.0/fs/mod.ts';
+import { resolve } from 'https://deno.land/std@0.224.0/path/mod.ts';
+
+/**
+ * Collects repeated occurrences of the `--environment` CLI option and validates
+ * that every entry adheres to `KEY=value` syntax.
+ *
+ * Cliffy calls this handler for *each* `--environment` argument. The previously
+ * accumulated values are passed in via the `previous` parameter, allowing us to
+ * build up the final array manually.
+ *
+ * @example
+ * ```ts
+ * // CLI invocation:
+ * //   mycli --environment FOO=bar --environment BAZ=qux
+ * const env = collectAndValidateEnv("FOO=bar");
+ * const env2 = collectAndValidateEnv("BAZ=qux", env);
+ * console.log(env2); // => ["FOO=bar", "BAZ=qux"]
+ * ```
+ *
+ * @param value - Current `KEY=value` string supplied by the user.
+ * @param previous - Array of values collected so far (defaults to an empty
+ *   array on the first call).
+ * @returns The updated array containing all validated `KEY=value` pairs.
+ *
+ * @throws {ValidationError} If the input does not match the required syntax
+ *   The resulting error is caught by Cliffy, which
+ *   will print a help message and terminate with a non-zero exit code.
+ */
+export function collectAndValidateEnv(
+    value: string,
+    previous: string[] = [],
+): string[] {
+    if (!/^\w+=.+/.test(value)) {
+        throw new ValidationError(t('error_invalid_env', { value }));
+    }
+    previous.push(value);
+    return previous;
+}
+
+/**
+ * Normalises a given path to its absolute representation and optionally checks
+ * whether it exists on the filesystem.
+ *
+ * @remarks
+ * Because `--home`, `--cwd`, `--output`, and similar options may refer to files
+ * or directories that *must* already exist, this helper performs the common
+ * validation in a single place.
+ *
+ * @param value - Path provided by the user (absolute or relative).
+ * @param mustExist - When `true`, the function asserts that the resolved path
+ *   exists; otherwise, existence is not verified.
+ * @returns The absolute path derived via {@linkcode resolve}.
+ *
+ * @throws {ValidationError}
+ *  - If `value` is empty or not a string.
+ *  - If `mustExist` is `true` **and** the resolved path cannot be found.
+ */
+export function validatePath(value: string, mustExist: boolean): string {
+    if (!value || typeof value !== 'string') {
+        throw new ValidationError(t('error_path_schold_not_be_empty'));
+    }
+    const abs = resolve(value);
+    if (mustExist && !existsSync(abs)) {
+        throw new ValidationError(t('error_path_not_found', { path: abs }));
+    }
+    return abs;
+}
+
+/**
+ * Ensures that a mandatory CLI argument is not empty.
+ *
+ * @param value - Raw string supplied by the user.
+ * @param label - Human-readable label identifying the option (used in error
+ *   messages). Example: `"--exec"`.
+ * @returns The original `value` if the validation passes.
+ *
+ * @throws {ValidationError} When `value` is `""`, `null`, `undefined`, or a
+ *   non-string.
+ */
+export function validateNotEmpty(value: string, label: string): string {
+    if (!value || typeof value !== 'string') {
+        throw new ValidationError(
+            t('error_value_should_not_be_empty', { label }),
+        );
+    }
+    return value;
+}
+
+/**
+ * Collects repeated occurrences of the `--after` CLI option, validating each
+ * target unit name and returning the aggregated list.
+ *
+ * The validation performed here is intentionally minimal – it merely checks
+ * that the argument is a non-empty string. Detailed identifier rules (ASCII
+ * characters, digits, etc.) are enforced elsewhere by
+ * {@link validateIdentifier} when appropriate.
+ *
+ * @param value - Unit name provided with the current `--after` occurrence.
+ * @param previous - Accumulated array of unit names (defaults to an empty
+ *   array).
+ * @returns An array containing all validated `--after` values.
+ *
+ * @throws {ValidationError} If `value` is empty.
+ */
+export function collectAndValidateAfter(
+    value: string,
+    previous: string[] = [],
+): string[] {
+    if (!value || typeof value !== 'string') {
+        throw new ValidationError(
+            t('error_value_should_not_be_empty', { label: '--after' }),
+        );
+    }
+    previous.push(value);
+    return previous;
+}
+
+/**
+ * Validates identifiers used in generated systemd unit file names (e.g.
+ * service or timer names) and option flags like `--run-as`.
+ *
+ * @example
+ * ```ts
+ * validateIdentifier("backup_job", "--name");   // OK
+ * validateIdentifier("foo.bar-baz", "--after"); // OK
+ * validateIdentifier("oops$", "--name");        // throws ValidationError
+ * ```
+ *
+ * @param value - The identifier string to validate.
+ * @param label - The relevant option flag, forwarded to the error message so
+ *   the user immediately sees which argument is wrong.
+ * @returns The unchanged `value` when it satisfies the pattern.
+ *
+ * @throws {ValidationError} If `value` contains characters outside the allowed
+ *   set of ASCII letters, digits, `.`, `_`, and `-`.
+ */
+export function validateIdentifier(value: string, label: string): string {
+    if (!/^[A-Za-z0-9_.-]+$/.test(value)) {
+        throw new ValidationError(
+            t('error_invalid_identifier', { identifier: label, value }),
+        );
+    }
+    return value;
+}
+
+/**
+ * Validates a systemd OnCalendar expression by invoking `systemd-analyze calendar`
+ * as a subprocess using a synchronous call. This avoids async overhead.
+ *
+ * @remarks
+ * Requires a Linux environment with systemd available.
+ *
+ * @param value - Calendar expression to validate
+ * @returns The original `value` if valid
+ * @throws {ValidationError} If the expression is invalid or systemd rejects it
+ */
+export function validateSystemdCalendar(value: string): string {
+    const command = new Deno.Command('systemd-analyze', {
+        args: ['calendar', value],
+        stdout: 'null',
+        stderr: 'null',
+    });
+
+    const { success } = command.outputSync();
+
+    if (!success) {
+        throw new ValidationError(
+            t('error_invalid_calendar', { value }),
+        );
+    }
+
+    return value;
+}

src/utils/mod.ts

@@ -1,3 +1,11 @@
+export {
+    collectAndValidateAfter,
+    collectAndValidateEnv,
+    validateIdentifier,
+    validateNotEmpty,
+    validatePath,
+    validateSystemdCalendar,
+} from './cliValidationHelper.ts';
 export { resolveUnitTargetPath, writeUnitFiles } from './fs.ts';
 export { deriveNameFromExec } from './misc.ts';
 export { getVersion } from './version.ts';