@sebastienrousseau/dotfiles 0.2.499 → 0.2.501

package/scripts/ci/check-copyright-headers.sh

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Copyright header validator (zero-tolerance policy).
+#
+# Scans source files for a copyright header in the first 10 lines. Patterns
+# are deliberately narrow to avoid false positives on C-style `(c)` comments
+# or the word "token" appearing in running text.
+#
+# Usage:
+#   check-copyright-headers.sh [--extensions=sh,lua,nix,...] [--excludes=REGEX]
+#
+# Exit codes:
+#   0  all files have a valid header
+#   1  one or more files are missing a header
+#   2  invalid invocation
+
+set -euo pipefail
+
+EXTENSIONS_DEFAULT="sh,lua,nix,py,js,ts,go,rs,java,cpp,c,h,hpp"
+EXCLUDES_DEFAULT='(^|/)(node_modules|\.git|vendor|target|build)/|\.tmpl$|(^|/)\.chezmoitemplates/'
+
+EXTENSIONS="$EXTENSIONS_DEFAULT"
+EXCLUDES="$EXCLUDES_DEFAULT"
+
+for arg in "$@"; do
+  case "$arg" in
+    --extensions=*) EXTENSIONS="${arg#*=}" ;;
+    --excludes=*) EXCLUDES="${arg#*=}" ;;
+    -h | --help)
+      sed -n '2,14p' "$0" | sed 's/^# \{0,1\}//'
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $arg" >&2
+      exit 2
+      ;;
+  esac
+done
+
+# Narrow patterns — each must be specific enough that running prose cannot match.
+# Deliberately DROPPED: bare "(c) " (false-positives in C comments),
+# bare "All rights reserved" (often appears in vendored prose).
+# Matched by `grep -F`, so these are literal strings.
+PATTERNS=(
+  "Copyright (c)"
+  "Copyright ©"
+  "SPDX-License-Identifier:"
+  "© "
+)
+
+# Build a ripgrep glob like `{*.sh,*.lua,*.nix}` from the comma list.
+IFS=',' read -r -a exts <<<"$EXTENSIONS"
+glob="{"
+for i in "${!exts[@]}"; do
+  [[ $i -gt 0 ]] && glob+=","
+  glob+="*.${exts[$i]}"
+done
+glob+="}"
+
+mapfile -t all_files < <(rg --files -g "$glob" 2>/dev/null || true)
+
+if [[ "${#all_files[@]}" -eq 0 ]]; then
+  echo "::notice::No files matched extensions: $EXTENSIONS"
+  exit 0
+fi
+
+missing=()
+for file in "${all_files[@]}"; do
+  if [[ "$file" =~ $EXCLUDES ]]; then
+    continue
+  fi
+
+  found=false
+  # Read the first 10 lines once; search each pattern against that buffer.
+  head_buf="$(head -n 10 "$file" 2>/dev/null || true)"
+  for pattern in "${PATTERNS[@]}"; do
+    if grep -qF -- "$pattern" <<<"$head_buf"; then
+      found=true
+      break
+    fi
+  done
+
+  $found || missing+=("$file")
+done
+
+if [[ "${#missing[@]}" -gt 0 ]]; then
+  echo "::error::Copyright header validation failed — ${#missing[@]} file(s) missing header"
+  echo "Files missing a recognised copyright header:"
+  printf '  - %s\n' "${missing[@]}"
+  echo
+  echo "Add ONE of the following to the first 10 lines:"
+  printf '  - %s\n' "${PATTERNS[@]}"
+  exit 1
+fi
+
+echo "::notice::All ${#all_files[@]} file(s) have a valid copyright header"

package/scripts/ci/check-dangerous-chmod.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# =============================================================================
+# check-dangerous-chmod.sh — block `chmod 777` / `chmod 666` patterns
+# from landing in shell scripts.
+#
+# Invoked as a pre-commit local hook (no filename args; scans the repo).
+# Extracted from `config/pre-commit-config.yaml` under #866.
+# =============================================================================
+
+set -euo pipefail
+
+PATTERN='^[[:space:]]*chmod[[:space:]]+(-R[[:space:]]+)?(777|666)'
+
+if grep -rn --include='*.sh' -E "$PATTERN" . 2>/dev/null | grep -v '^Binary'; then
+  echo "ERROR: Dangerous chmod patterns found (777 or 666)." >&2
+  echo "Use the minimum permissions actually required; document any exception." >&2
+  exit 1
+fi

package/scripts/ci/check-deps-dev.sh

@@ -0,0 +1,236 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# =============================================================================
+# check-deps-dev.sh — Validate direct dependencies against the deps.dev
+# Insights API. Catches supply-chain risk a Grype-only scan misses:
+# stale-but-CVE-free packages, unattested artifacts, and packages with
+# advisories that haven't yet been mapped to a CVE.
+#
+# Scans:
+#   * `package.json` — direct `dependencies` + `devDependencies` (npm).
+#   * `pyproject.toml` — direct `[project.dependencies]` (Python).
+#   * `.github/workflows/*.yml` — `uses:` action references (GitHub Actions).
+#
+# Skips ecosystems with no matching manifest.
+#
+# Exit codes:
+#   0  no advisories found (or all under threshold).
+#   1  one or more direct deps have advisories at or above the threshold.
+#   2  prerequisites missing (jq / curl / python3).
+#
+# Closes part of #877.
+# =============================================================================
+
+set -uo pipefail
+
+REPO_ROOT="${REPO_ROOT:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
+THRESHOLD="${DEPS_DEV_SEVERITY_THRESHOLD:-HIGH}" # LOW | MEDIUM | HIGH | CRITICAL
+DEPS_DEV_BASE="${DEPS_DEV_BASE:-https://api.deps.dev/v3}"
+EXCEPTIONS_FILE="$REPO_ROOT/docs/security/DEPS_DEV_EXCEPTIONS.md"
+SARIF_OUT="${DEPS_DEV_SARIF_OUT:-}"
+
+# Strict mode: bail on prerequisites.
+for cmd in jq curl python3; do
+  if ! command -v "$cmd" >/dev/null 2>&1; then
+    echo "::warning::check-deps-dev: $cmd not available — skipping." >&2
+    exit 0
+  fi
+done
+
+# -----------------------------------------------------------------------------
+# Helpers
+# -----------------------------------------------------------------------------
+
+# severity_rank — map deps.dev severity strings to integers so we can
+# compare against THRESHOLD numerically.
+severity_rank() {
+  case "${1:-}" in
+    CRITICAL) echo 4 ;;
+    HIGH) echo 3 ;;
+    MEDIUM | MODERATE) echo 2 ;;
+    LOW) echo 1 ;;
+    *) echo 0 ;;
+  esac
+}
+
+THRESHOLD_RANK=$(severity_rank "$THRESHOLD")
+
+# is_excepted — check if a (system, name) pair has an active exception
+# entry in DEPS_DEV_EXCEPTIONS.md. Exceptions look like:
+#   `npm:lodash` (expires 2026-12-31): <reason>
+is_excepted() {
+  local system="$1" name="$2"
+  [[ -f "$EXCEPTIONS_FILE" ]] || return 1
+  grep -Eq "^\s*\`${system}:${name}\`" "$EXCEPTIONS_FILE"
+}
+
+# fetch_advisories — query deps.dev for advisories on a (system, name,
+# version) triple. Prints one advisory-key per line; empty if none.
+fetch_advisories() {
+  local system="$1" name="$2" version="$3"
+  local encoded_name
+  encoded_name=$(python3 -c 'import urllib.parse, sys; print(urllib.parse.quote(sys.argv[1], safe=""))' "$name")
+  local url="$DEPS_DEV_BASE/systems/$system/packages/$encoded_name/versions/$version"
+  curl -fsSL --max-time 15 "$url" 2>/dev/null |
+    jq -r '.advisoryKeys[]?.id // empty' 2>/dev/null ||
+    true
+}
+
+# fetch_advisory_severity — given an advisory ID, return its highest
+# severity rating. Returns empty string when the API doesn't expose
+# severity (older advisories sometimes lack it).
+fetch_advisory_severity() {
+  local advisory_id="$1"
+  local encoded
+  encoded=$(python3 -c 'import urllib.parse, sys; print(urllib.parse.quote(sys.argv[1], safe=""))' "$advisory_id")
+  curl -fsSL --max-time 15 "$DEPS_DEV_BASE/advisories/$encoded" 2>/dev/null |
+    jq -r '.severity[]?.type // empty' 2>/dev/null |
+    head -1 ||
+    true
+}
+
+# -----------------------------------------------------------------------------
+# Manifest readers
+# -----------------------------------------------------------------------------
+
+# Each reader prints one "system\tname\tversion" line per direct dep.
+
+read_npm() {
+  local pkg="$REPO_ROOT/package.json"
+  [[ -f "$pkg" ]] || return 0
+  jq -r '
+    [.dependencies // {}, .devDependencies // {}]
+    | add // {}
+    | to_entries[]
+    | "NPM\t\(.key)\t\(.value | sub("^[~^>=<]+"; ""))"
+  ' "$pkg"
+}
+
+read_pypi() {
+  local pyproj="$REPO_ROOT/pyproject.toml"
+  [[ -f "$pyproj" ]] || return 0
+  python3 - "$pyproj" <<'PY'
+import sys
+try:
+    import tomllib
+except ImportError:
+    try:
+        import tomli as tomllib  # type: ignore
+    except ImportError:
+        sys.exit(0)
+data = tomllib.load(open(sys.argv[1], "rb"))
+deps = data.get("project", {}).get("dependencies", [])
+for spec in deps:
+    # spec is like "requests>=2.28.0"; pull name + version.
+    name = spec.split("[")[0].split(">")[0].split("<")[0].split("=")[0].strip()
+    version = ""
+    for op in (">=", "<=", "==", ">", "<"):
+        if op in spec:
+            version = spec.split(op, 1)[1].strip().split(",")[0]
+            break
+    print(f"PYPI\t{name}\t{version}")
+PY
+}
+
+read_actions() {
+  local f
+  for f in "$REPO_ROOT"/.github/workflows/*.yml; do
+    [[ -f "$f" ]] || continue
+    # Match `uses: owner/repo@<40-hex-sha> # vX.Y.Z`
+    grep -Eo 'uses:[[:space:]]+[a-zA-Z0-9._-]+/[a-zA-Z0-9._/-]+@[a-f0-9]{40}[[:space:]]*#[[:space:]]*v[0-9.]+' "$f" |
+      sed -E 's/uses:[[:space:]]+([^@]+)@[a-f0-9]{40}[[:space:]]+#[[:space:]]+v([0-9.]+).*/GITHUB_ACTIONS\t\1\t\2/' ||
+      true
+  done | sort -u
+}
+
+# -----------------------------------------------------------------------------
+# Main scan
+# -----------------------------------------------------------------------------
+
+findings=()
+total_scanned=0
+
+scan_one() {
+  local system="$1" name="$2" version="$3"
+  [[ -z "$name" || -z "$version" ]] && return 0
+  total_scanned=$((total_scanned + 1))
+
+  if is_excepted "$system" "$name"; then
+    echo "  - skip $system:$name@$version (excepted)" >&2
+    return 0
+  fi
+
+  local advs
+  advs=$(fetch_advisories "$system" "$name" "$version")
+  [[ -z "$advs" ]] && return 0
+
+  while IFS= read -r adv; do
+    [[ -z "$adv" ]] && continue
+    local sev
+    sev=$(fetch_advisory_severity "$adv")
+    local rank
+    rank=$(severity_rank "$sev")
+    if ((rank >= THRESHOLD_RANK)); then
+      findings+=("$system:$name@$version :: $adv ($sev)")
+      echo "::warning::deps.dev advisory $sev: $system $name $version → $adv" >&2
+    fi
+  done <<<"$advs"
+}
+
+echo "Scanning manifests under $REPO_ROOT ..." >&2
+
+# 1. npm
+while IFS=$'\t' read -r system name version; do
+  scan_one "$system" "$name" "$version"
+done < <(read_npm)
+
+# 2. pypi
+while IFS=$'\t' read -r system name version; do
+  scan_one "$system" "$name" "$version"
+done < <(read_pypi)
+
+# 3. GitHub Actions (best-effort — deps.dev coverage is partial)
+while IFS=$'\t' read -r system name version; do
+  scan_one "$system" "$name" "$version"
+done < <(read_actions)
+
+echo "Scanned $total_scanned direct dependencies." >&2
+
+# Optional SARIF emission for Code Scanning upload.
+if [[ -n "$SARIF_OUT" ]]; then
+  python3 - "$SARIF_OUT" "${findings[@]+"${findings[@]}"}" <<'PY'
+import json, sys
+out = sys.argv[1]
+findings = sys.argv[2:]
+runs = [{
+    "tool": {"driver": {
+        "name": "check-deps-dev",
+        "version": "1.0.0",
+        "informationUri": "https://deps.dev",
+    }},
+    "results": [
+        {
+            "ruleId": "deps-dev-advisory",
+            "level": "error",
+            "message": {"text": f},
+        }
+        for f in findings
+    ],
+}]
+with open(out, "w") as fp:
+    json.dump({"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": runs}, fp)
+print(f"SARIF written: {out}")
+PY
+fi
+
+if [[ "${#findings[@]}" -gt 0 ]]; then
+  echo "" >&2
+  echo "::error::${#findings[@]} dep(s) flagged at or above ${THRESHOLD}." >&2
+  printf '  %s\n' "${findings[@]}" >&2
+  echo "" >&2
+  echo "Document exceptions at docs/security/DEPS_DEV_EXCEPTIONS.md with expiry dates." >&2
+  exit 1
+fi
+
+echo "deps.dev validation: clean." >&2
+exit 0

package/scripts/ci/check-insecure-tls.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# =============================================================================
+# check-insecure-tls.sh — block `curl -k` / `curl --insecure` /
+# `wget --no-check-certificate` patterns from landing.
+#
+# Invoked as a pre-commit local hook (no filename args; scans the repo).
+# Extracted from `config/pre-commit-config.yaml` under #866 so the line
+# is yamllint-clean and the matcher can be tested in isolation.
+#
+# Matcher uses awk for proper tokenization (the previous inline grep
+# regex false-positive'd `-k` inside package names like `-keyring`).
+# =============================================================================
+
+set -euo pipefail
+
+ROOT="${1:-.}"
+
+# Awk body intentionally lives in a variable. The $i / $NF / FILENAME /
+# NR references inside are awk's own field/record variables — NOT shell
+# variables — so the whole body must stay literal (single-quoted). The
+# SC2016 suppression is the canonical signal to readers + linters that
+# this is intentional.
+# shellcheck disable=SC2016
+AWK_BODY='
+  # Each input line tokenized on whitespace. Flag if the line uses
+  # curl/wget and a known insecure flag appears as a standalone token.
+  {
+    has_curl = 0; has_wget = 0
+    bad = ""
+    for (i = 1; i <= NF; i++) {
+      tok = $i
+      if (tok == "curl") has_curl = 1
+      if (tok == "wget") has_wget = 1
+      if (has_curl && (tok == "-k" || tok == "--insecure" || tok ~ /^--insecure=/)) {
+        bad = tok
+      }
+      if (has_wget && (tok == "--no-check-certificate" || tok ~ /^--no-check-certificate=/)) {
+        bad = tok
+      }
+    }
+    if (bad != "") printf "%s:%d:%s\n", FILENAME, NR, bad
+  }
+'
+
+matches=$(
+  grep -rln \
+    --include='*.sh' --include='*.bash' --include='*.zsh' --include='*.tmpl' \
+    --exclude-dir='.git' \
+    --exclude='check-insecure-tls.sh' \
+    -E '\b(curl|wget)\b' \
+    "$ROOT" 2>/dev/null |
+    xargs -I{} awk "$AWK_BODY" {} 2>/dev/null
+)
+
+if [[ -n "$matches" ]]; then
+  echo "ERROR: Insecure TLS patterns found." >&2
+  echo "$matches" >&2
+  echo "Remove the flag or, if absolutely required, pin the cert and document the why." >&2
+  exit 1
+fi

package/scripts/ci/check-regression-traceability.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# =============================================================================
+# check-regression-traceability.sh — enforce a `# Regression for:` header on
+# every file under `tests/regression/`, with one of three accepted forms:
+#
+#   # Regression for: GH-1234
+#   # Regression for: <7-or-more-char-sha-prefix>
+#   # Regression for: pre-history
+#
+# The first two are required for any test introduced as part of fixing a
+# known issue or shipping a known commit. The third is an explicit "we
+# couldn't trace it" marker — still trackable, just not auto-resolvable.
+#
+# Invocation:
+#   * pre-commit local hook (files passed as args)
+#   * standalone: ./scripts/ci/check-regression-traceability.sh
+# =============================================================================
+
+set -euo pipefail
+
+PATTERN='^# *Regression for: *(GH-[0-9]+|[0-9a-f]{7,40}|pre-history)\b'
+
+check_one() {
+  local f="$1"
+  [[ -f "$f" ]] || return 0
+
+  # Only check files under tests/regression/
+  case "$f" in
+    tests/regression/*) ;;
+    */tests/regression/*) ;;
+    *) return 0 ;;
+  esac
+
+  if ! head -15 "$f" | grep -Eq "$PATTERN"; then
+    echo "MISSING trace header: $f"
+    return 1
+  fi
+}
+
+fail=0
+if [[ $# -gt 0 ]]; then
+  for f in "$@"; do
+    check_one "$f" || fail=1
+  done
+else
+  while IFS= read -r f; do
+    check_one "$f" || fail=1
+  done < <(git ls-files "tests/regression/*.sh")
+fi
+
+if [[ $fail -ne 0 ]]; then
+  cat >&2 <<'MSG'
+
+Every file under tests/regression/ must include a trace header within
+the first 15 lines, in one of these forms:
+
+  # Regression for: GH-1234            (preferred — link to GitHub issue)
+  # Regression for: <sha-prefix>       (link to introducing commit)
+  # Regression for: pre-history        (no traceable origin)
+
+Why: regressions pinned years ago without context are forensic dead-ends
+when they fire. See docs/operations/TESTING.md and #868.
+
+MSG
+  exit 1
+fi

package/scripts/ci/check-shell-preamble.sh

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# =============================================================================
+# check-shell-preamble.sh — Enforce `set -euo pipefail` (bash) / `set -eu` (sh)
+# on every executable shell script in the repo.
+#
+# Skip-rules:
+#   * Sourced libraries that declare themselves as such via a "Sourced by ..."
+#     header comment in the first 15 lines.
+#   * Explicit opt-out via `# preamble:skip` marker in the first 15 lines
+#     (used by completion files, init fragments, and other library code that
+#     is loaded into the caller's shell context).
+#   * Files under tests/ (the test runner sets shell options for its children).
+#
+# Invocation:
+#   * pre-commit local hook (files passed as args)
+#   * standalone: ./scripts/ci/check-shell-preamble.sh           # full repo
+#                 ./scripts/ci/check-shell-preamble.sh file.sh   # explicit
+# =============================================================================
+
+set -euo pipefail
+
+check_one() {
+  local f="$1"
+
+  [[ -f "$f" ]] || return 0
+
+  local shebang
+  shebang="$(head -1 "$f" 2>/dev/null || true)"
+
+  # Only check files with a bash or sh shebang.
+  case "$shebang" in
+    *bash*) ;;
+    *sh) ;;
+    *) return 0 ;;
+  esac
+
+  # Skip files declaring themselves as sourced libraries or opting out.
+  if head -15 "$f" | grep -Eq '^# *(Sourced by |preamble:skip|shellcheck source-only)'; then
+    return 0
+  fi
+
+  # Skip the test suite — tests are sourced by tests/framework/test_runner.sh
+  # which manages shell options for its children.
+  case "$f" in
+    tests/*) return 0 ;;
+    # Bulk-sourced fragments. These directories contain hundreds of
+    # alias / function / PATH snippets that are sourced into the
+    # caller's shell context — adding `set -e` locally would corrupt
+    # the caller. Path-skipped en masse rather than annotated per-file
+    # (would be 300+ marker comments).
+    .chezmoitemplates/aliases/*) return 0 ;;
+    .chezmoitemplates/functions/*) return 0 ;;
+    .chezmoitemplates/paths/*) return 0 ;;
+    # dot_config/shell/* and scripts/dot/lib/* are also sourced but
+    # have explicit `# Sourced by` headers as of #854 (defense in
+    # depth — the lint also accepts them on header alone).
+    dot_local/bin/executable_dot_completion) return 0 ;; # zsh completion, sourced into shell
+  esac
+
+  # Required preamble lives within the first 50 lines (after optional docstring).
+  local preamble_re
+  case "$shebang" in
+    *bash*)
+      preamble_re='^[[:space:]]*set[[:space:]]+-([eu]+o[[:space:]]+pipefail|euo[[:space:]]+pipefail|eu[[:space:]]*$)'
+      ;;
+    *sh)
+      preamble_re='^[[:space:]]*set[[:space:]]+-eu[o]?'
+      ;;
+  esac
+
+  if ! head -50 "$f" | grep -Eq "$preamble_re"; then
+    echo "MISSING preamble: $f"
+    return 1
+  fi
+}
+
+fail=0
+if [[ $# -gt 0 ]]; then
+  for f in "$@"; do
+    check_one "$f" || fail=1
+  done
+else
+  # Full-repo scan
+  while IFS= read -r f; do
+    check_one "$f" || fail=1
+  done < <(git ls-files | grep -E '\.sh$|^dot_local/bin/executable_|^scripts/.+\.sh$')
+fi
+
+if [[ $fail -ne 0 ]]; then
+  cat >&2 <<'MSG'
+
+Some shell scripts are missing the safety preamble.
+  * bash → `set -euo pipefail`
+  * sh   → `set -eu`
+
+If the file is a sourced library, add this header to its first 15 lines:
+  # Sourced by <parent>.sh; inherits set -euo pipefail
+
+If the file is a shell init fragment / completion that must NOT enforce its own
+options on the caller, add this marker instead:
+  # preamble:skip
+
+MSG
+  exit 1
+fi

package/scripts/ci/guard-gitleaks-checkout.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Guard against full-history gitleaks scans on manual runs.
+# This ensures workflow checkout remains shallow near gitleaks steps.
+
+set -euo pipefail
+
+check_workflow() {
+  local workflow="$1"
+  local failed=0
+  local line_no
+
+  while IFS=: read -r line_no _; do
+    local start end context
+    start=$((line_no - 16))
+    end=$((line_no + 2))
+    if [[ "$start" -lt 1 ]]; then
+      start=1
+    fi
+
+    context="$(sed -n "${start},${end}p" "$workflow")"
+
+    if [[ "$context" != *"actions/checkout"* ]]; then
+      echo "ERROR: $workflow:$line_no missing nearby checkout for gitleaks step."
+      failed=1
+      continue
+    fi
+
+    if [[ "$context" != *"fetch-depth: 1"* ]]; then
+      echo "ERROR: $workflow:$line_no gitleaks step must use checkout fetch-depth: 1."
+      failed=1
+    fi
+
+    if [[ "$context" == *"fetch-depth: 0"* ]]; then
+      echo "ERROR: $workflow:$line_no gitleaks step contains forbidden fetch-depth: 0."
+      failed=1
+    fi
+  done < <(grep -n "gitleaks/gitleaks-action" "$workflow" || true)
+
+  return "$failed"
+}
+
+main() {
+  local failed=0
+
+  check_workflow ".github/workflows/ci.yml" || failed=1
+  check_workflow ".github/workflows/security-enhanced.yml" || failed=1
+
+  if [[ "$failed" -ne 0 ]]; then
+    echo "Gitleaks checkout guard failed."
+    exit 1
+  fi
+
+  echo "Gitleaks checkout guard passed."
+}
+
+main "$@"