#!/usr/bin/env bash
# Install a pinned gitleaks release into a directory, verifying its sha256.
#
# Usage: scripts/ci/install_gitleaks.sh <dest-dir>
#
# The binary ends up at <dest-dir>/gitleaks. To upgrade, bump GITLEAKS_VERSION
# and both digests from the release's gitleaks_<version>_checksums.txt.
set -euo pipefail

GITLEAKS_VERSION="8.30.1"
SHA256_X64="551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
SHA256_ARM64="e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080"

dest="${1:?usage: install_gitleaks.sh <dest-dir>}"

case "$(uname -m)" in
  x86_64 | amd64)
    arch="x64"
    expected="${SHA256_X64}"
    ;;
  aarch64 | arm64)
    arch="arm64"
    expected="${SHA256_ARM64}"
    ;;
  *)
    echo "unsupported architecture: $(uname -m)" >&2
    exit 1
    ;;
esac

archive="gitleaks_${GITLEAKS_VERSION}_linux_${arch}.tar.gz"
url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${archive}"

work="$(mktemp -d)"
trap 'rm -rf "${work}"' EXIT

curl --fail --silent --show-error --location --retry 3 --output "${work}/${archive}" "${url}"
echo "${expected}  ${work}/${archive}" | sha256sum --check --status || {
  echo "sha256 mismatch for ${archive}" >&2
  exit 1
}

mkdir -p "${dest}"
tar -xzf "${work}/${archive}" -C "${dest}" gitleaks
chmod 0755 "${dest}/gitleaks"
"${dest}/gitleaks" version