Latte
1a039e32ab
Replace lint/test/docker workflows with ci.yml (gitleaks, lint, test-unit, test-integration, test-mcp, build-and-push, docs-check, security). Rebuild the Dockerfile as a digest-pinned multi-stage uv build running as uid 1000, add .dockerignore, a hardened compose file and a gitleaks config. The integration harness now falls back to /etc/hostname and /proc/self to find its own container.
47 lines
1.3 KiB
Bash
Executable File
47 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Install a pinned gitleaks release into a directory, verifying its sha256.
|
|
#
|
|
# Usage: scripts/ci/install_gitleaks.sh <dest-dir>
|
|
#
|
|
# The binary ends up at <dest-dir>/gitleaks. To upgrade, bump GITLEAKS_VERSION
|
|
# and both digests from the release's gitleaks_<version>_checksums.txt.
|
|
set -euo pipefail
|
|
|
|
GITLEAKS_VERSION="8.30.1"
|
|
SHA256_X64="551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
|
|
SHA256_ARM64="e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080"
|
|
|
|
dest="${1:?usage: install_gitleaks.sh <dest-dir>}"
|
|
|
|
case "$(uname -m)" in
|
|
x86_64 | amd64)
|
|
arch="x64"
|
|
expected="${SHA256_X64}"
|
|
;;
|
|
aarch64 | arm64)
|
|
arch="arm64"
|
|
expected="${SHA256_ARM64}"
|
|
;;
|
|
*)
|
|
echo "unsupported architecture: $(uname -m)" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
archive="gitleaks_${GITLEAKS_VERSION}_linux_${arch}.tar.gz"
|
|
url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${archive}"
|
|
|
|
work="$(mktemp -d)"
|
|
trap 'rm -rf "${work}"' EXIT
|
|
|
|
curl --fail --silent --show-error --location --retry 3 --output "${work}/${archive}" "${url}"
|
|
echo "${expected} ${work}/${archive}" | sha256sum --check --status || {
|
|
echo "sha256 mismatch for ${archive}" >&2
|
|
exit 1
|
|
}
|
|
|
|
mkdir -p "${dest}"
|
|
tar -xzf "${work}/${archive}" -C "${dest}" gitleaks
|
|
chmod 0755 "${dest}/gitleaks"
|
|
"${dest}/gitleaks" version
|