blackboardxray 0.1.0__tar.gz

blackboardxray-0.1.0/.editorconfig

@@ -0,0 +1,22 @@
+# One answer per file type, so an editor does not have to guess and a diff does
+# not carry somebody else's settings.
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 4
+
+[*.{js,jsx,ts,tsx,json,jsonc,css,html,yml,yaml,mjs}]
+indent_size = 2
+
+[*.md]
+# A trailing double space is a line break in Markdown, and trimming it changes
+# what the document says.
+trim_trailing_whitespace = false
+
+[Makefile]
+indent_style = tab

blackboardxray-0.1.0/.gitattributes

@@ -0,0 +1,20 @@
+# One line ending everywhere, decided here rather than by whichever machine
+# checked the file out.
+* text=auto eol=lf
+
+# Generated. Marked so a diff view collapses them and a language survey does not
+# count them as something somebody wrote.
+CHANGELOG.md      linguist-generated=true
+uv.lock           linguist-generated=true -diff
+ui/package-lock.json linguist-generated=true -diff
+ui/src/styles/tokens.css linguist-generated=true -diff
+ui/src/styles/theme.css  linguist-generated=true -diff
+ui/tokens/primitive/color.json linguist-generated=true -diff
+
+# Not the product. The interface's own source is, but its lockfile is not, and
+# the fixtures are not.
+examples/**   linguist-documentation=true
+docs/**       linguist-documentation=true
+
+*.png binary
+*.woff2 binary

blackboardxray-0.1.0/.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,80 @@
+name: Bug report
+description: Something behaves differently from what it says it does
+labels: ["type:fix"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thank you for the report. The two fields that matter most are what you
+        expected and what happened, in that order.
+
+        If this is a security vulnerability, do not open an issue. `SECURITY.md`
+        says where to send it privately.
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: What you expected
+      description: What should have happened, and what made you expect it.
+    validations:
+      required: true
+
+  - type: textarea
+    id: happened
+    attributes:
+      label: What happened instead
+      description: Include the exact error or the exact wrong value, not a paraphrase.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: How to see it
+      description: >
+        The shortest path from a fresh install to the wrong behaviour. A failing
+        test is the best possible version of this.
+      placeholder: |
+        1. docker compose up -d
+        2. Set up, then ...
+        3. The runs list shows ...
+    validations:
+      required: true
+
+  - type: dropdown
+    id: where
+    attributes:
+      label: Where
+      options:
+        - The server or the API
+        - The interface
+        - The client that sends events
+        - Installing or upgrading
+        - Somewhere else, or not sure
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: >
+        The image tag, or `pip show blackboardxray`, or the commit you are on.
+      placeholder: "0.1.0, or ghcr.io/moeinroghani/blackboardxray:1"
+    validations:
+      required: true
+
+  - type: input
+    id: postgres
+    attributes:
+      label: Postgres version
+      placeholder: "17.2"
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: >
+        `docker compose logs xray`, or the server's output. Take the request
+        identifier out of the failing response if you have it.
+      render: text

blackboardxray-0.1.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,16 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Question, or an idea you want to talk through
+    url: https://github.com/MoeinRoghani/blackboardxray/discussions
+    about: >
+      Discussions, rather than the issue tracker. An issue is a thing to be
+      done; a question is not, and it gets a better answer there.
+  - name: Security vulnerability
+    url: https://github.com/MoeinRoghani/blackboardxray/security/advisories/new
+    about: >
+      Report it privately. Please do not open an issue for a vulnerability.
+  - name: How to run this yourself
+    url: https://github.com/MoeinRoghani/blackboardxray/blob/main/docs/self-hosting.md
+    about: >
+      Every environment variable, the proxy headers that matter, backup,
+      upgrading, and what this deliberately does not do.

blackboardxray-0.1.0/.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,46 @@
+name: Feature request
+description: Something this should do and does not
+labels: ["type:feat"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        The most useful requests describe a problem rather than a solution. What
+        you cannot currently find out about a run is more actionable than which
+        control you would like added.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: What you cannot do today
+      description: The situation you are in and what you end up doing instead.
+    validations:
+      required: true
+
+  - type: textarea
+    id: shape
+    attributes:
+      label: What would solve it
+      description: >
+        If you have a shape in mind, describe it. If you do not, say so; that is
+        a legitimate answer and often a better one.
+    validations:
+      required: true
+
+  - type: textarea
+    id: considered
+    attributes:
+      label: What you have already tried
+      description: >
+        Including whether an existing view nearly does it. Knowing what nearly
+        works says more than a blank field.
+
+  - type: checkboxes
+    id: scope
+    attributes:
+      label: Before you send this
+      options:
+        - label: >
+            I have read the end of `docs/self-hosting.md`, and this is not one of
+            the things the project has deliberately decided not to do.
+          required: true

blackboardxray-0.1.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,34 @@
+## What this changes
+
+<!-- What is different afterwards, for somebody using this. One or two
+     sentences. The title is the release note; this is the reason. -->
+
+## Why
+
+<!-- The problem. If there is an issue, say `Closes #N` and this can be short. -->
+
+Closes #
+
+## How it was checked
+
+<!-- What you ran, and what a reviewer should run to see it. If this fixes a
+     bug, name the test that failed before the change. -->
+
+- [ ] `make verify` passes with `BLACKBOARDXRAY_TEST_DSN` set to a real database
+- [ ] A test fails against the unmodified code and passes against this one
+- [ ] The documentation this affects is updated in this pull request
+
+---
+
+<!--
+Two things this body must satisfy, both checked by a workflow.
+
+NO PARENTHESES. The squash merge writes this body into the commit message and
+release-please parses that message. A parenthesis defeats its parser silently:
+the commit is dropped from the release notes while every check stays green.
+Commas, semicolons and separate sentences carry the same meaning.
+
+A BREAKING CHANGE carries both a `!` in the title and a `BREAKING CHANGE:`
+footer here, stating what changed and what a caller writes instead. Both, not
+either.
+-->

blackboardxray-0.1.0/.github/dependabot.yml

@@ -0,0 +1,44 @@
+# Four ecosystems, because this project has four. The interface has its own
+# dependency tree and would otherwise never be updated, and the base images in
+# the Dockerfile age the same way a package does.
+version: 2
+updates:
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "build"
+
+  - package-ecosystem: "npm"
+    directory: "/ui"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "build"
+    groups:
+      # One pull request for the interface's development tooling rather than
+      # one per package. They move together and are checked by the same build.
+      interface-tooling:
+        patterns:
+          - "@types/*"
+          - "typescript"
+          - "vite"
+          - "@vitejs/*"
+          - "tailwindcss"
+          - "@tailwindcss/*"
+          - "playwright"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "ci"
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "build"

blackboardxray-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,136 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  python:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.11", "3.12", "3.13"]
+    services:
+      postgres:
+        image: postgres:17
+        env:
+          POSTGRES_USER: xray
+          POSTGRES_PASSWORD: xray
+          POSTGRES_DB: xray_test
+        ports: ["5432:5432"]
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 3s
+          --health-retries 10
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb # v6.1.0
+        with:
+          python-version: ${{ matrix.python }}
+      # From the lockfile, into a virtual environment. `--system` installs into
+      # the runner's own interpreter, which Debian marks externally managed and
+      # refuses, and `--frozen` is what makes this run the versions the lock
+      # names rather than whatever resolved this morning.
+      - run: uv sync --frozen --python ${{ matrix.python }}
+      - run: uv run ruff check src tests examples
+      - run: uv run ruff format --check src tests examples
+      - run: uv run mypy src
+      # The database tests skip where no server is named. Naming one here is
+      # what stops them silently skipping in the only place it matters.
+      - name: The suite, against a real Postgres
+        run: |
+          uv run pytest -q --strict-markers 2>&1 | tee /tmp/out
+          if grep -qE "[0-9]+ skipped" /tmp/out; then
+            echo
+            echo "A test skipped. Every skip in this suite means the database"
+            echo "was not reachable, which makes a green run a green run of"
+            echo "about a third of what there is."
+            exit 1
+          fi
+        env:
+          BLACKBOARDXRAY_TEST_DSN: postgresql://xray:xray@localhost:5432/xray_test
+
+  interface:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          node-version: "24"
+      - run: npm install
+        working-directory: ui
+      # The token pipeline, the raw-value gate, the contrast gate, and tsc.
+      # A screen that sets a value or a pair below its contrast floor fails here.
+      - run: npm run verify
+        working-directory: ui
+      - run: npm run build
+        working-directory: ui
+
+      # What `pip install blackboardxray[server]` actually gets. The interface
+      # is generated and gitignored, and a build backend that skips what
+      # version control ignores ships a server serving a blank page. It has
+      # happened twice: once because the wheel target did not name it, and
+      # once because the sdist did not and the wheel is built from the sdist.
+      - uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb # v6.1.0
+        with:
+          python-version: "3.12"
+      - name: the interface is in both distributions
+        run: |
+          set -euo pipefail
+          uv build
+          # Listed to a file first. `grep -q` exits on its first match and
+          # closes the pipe, `tar` then fails writing to it, and `pipefail`
+          # fails the step for a check that actually passed.
+          tar tzf dist/*.tar.gz > /tmp/sdist.txt
+          unzip -l dist/*.whl > /tmp/wheel.txt
+          grep -q "server/web/index.html" /tmp/sdist.txt
+          echo "the sdist carries the interface"
+          grep -q "server/web/index.html" /tmp/wheel.txt
+          test "$(grep -c "server/web/assets/" /tmp/wheel.txt)" -gt 0
+          echo "the wheel carries the interface and its assets"
+
+  # The quickstart in the README, run as written. A compose file that has drifted
+  # from the Dockerfile is a first impression nobody recovers from, and it is
+  # exactly the kind of break the unit tests cannot see.
+  compose:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - run: docker compose up -d --build --wait --wait-timeout 300
+      - name: The platform answers and says it needs setting up
+        run: |
+          set -euo pipefail
+          test "$(curl -sf localhost:8900/api/v1/ready | jq -r .status)" = ready
+          test "$(curl -sf localhost:8900/api/v1/auth/state | jq -r .needs_setup)" = true
+      - name: The first run makes an owner, a project and a key that sends
+        run: |
+          set -euo pipefail
+          key=$(curl -sf -X POST localhost:8900/api/v1/setup \
+            -H 'content-type: application/json' \
+            -H 'origin: http://localhost:8900' \
+            -d '{"email":"ci@example.com","password":"a long enough phrase",
+                 "organization":"CI","project":"Production"}' | jq -r .api_key)
+          test -n "$key"
+          curl -sf -X POST localhost:8900/api/v1/ingest \
+            -H "authorization: Bearer $key" -H 'content-type: application/json' \
+            -d '{"events":[{"board_id":"ci-1","kind":"run.opened"}]}' \
+            | jq -e '.stored == 1'
+      - name: Reading without a session is refused
+        run: |
+          set -euo pipefail
+          code=$(curl -s -o /dev/null -w '%{http_code}' \
+            localhost:8900/api/v1/projects/proj_nothing/overview)
+          test "$code" = 401
+      - name: The interface is served, not just the API
+        run: curl -sf localhost:8900/ | grep -q "<div id=\"root\">"
+      - if: failure()
+        run: docker compose logs --no-color | tail -80
+      - if: always()
+        run: docker compose down -v

blackboardxray-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,167 @@
+# What a tag does.
+#
+# release-please keeps the version and the changelog from the commit subjects
+# on main, and opens a pull request that holds them. Merging that pull request
+# tags the release, and the tag builds the image and publishes the client.
+#
+# Nothing here is done by a person, because a release done by hand is a release
+# whose steps are remembered differently each time. The one exception is the
+# recovery path: a tag whose artefacts failed to publish can be published again
+# without cutting a second tag, which is what `workflow_dispatch` is for.
+name: Release
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "An existing tag to publish, when its artefacts failed"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  # This job always runs and its one step does not. A skipped job propagates
+  # its skip down the whole needs chain, and overriding that in each job below
+  # was tried and did not work; having nothing skipped is simpler than
+  # explaining to every downstream job that a skip upstream was expected.
+  please:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    outputs:
+      released: ${{ steps.please.outputs.release_created }}
+      tag: ${{ steps.please.outputs.tag_name }}
+    steps:
+      - uses: googleapis/release-please-action@a02a34c4d625f9be7cb89156071d8567266a2445 # v4.1.3
+        id: please
+        if: github.event_name == 'push'
+        with:
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+  # What to publish, from whichever of the two ways this ran. One job, so the
+  # two below say `needs.plan` and never care which it was.
+  plan:
+    needs: [please]
+    if: needs.please.outputs.released == 'true' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    outputs:
+      tag: ${{ steps.what.outputs.tag }}
+      version: ${{ steps.what.outputs.version }}
+      major: ${{ steps.what.outputs.major }}
+      minor: ${{ steps.what.outputs.minor }}
+    steps:
+      - id: what
+        env:
+          TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || needs.please.outputs.tag }}
+        run: |
+          set -euo pipefail
+          version="${TAG#v}"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "major=${version%%.*}" >> "$GITHUB_OUTPUT"
+          rest="${version#*.}"
+          echo "minor=${rest%%.*}" >> "$GITHUB_OUTPUT"
+
+  image:
+    needs: [plan]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      # Signing the provenance attestation.
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.plan.outputs.tag }}
+      - uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
+      - uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
+      - uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # A registry name must be lowercase and a GitHub owner need not be, so
+      # `github.repository` cannot be used as an image name directly. The build
+      # refused the tag rather than mangling it, which is the right failure and
+      # is only useful once somebody folds the case here.
+      - name: the image name, lowercased
+        id: name
+        run: echo "image=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
+
+      - uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
+        id: build
+        with:
+          context: .
+          # A bill of materials and a provenance attestation, so somebody who
+          # pulled this can ask what is in it and who built it rather than
+          # taking the tag's word for it.
+          sbom: true
+          provenance: mode=max
+          # Two architectures, because half of the people running this are on
+          # an ARM laptop and the other half are on an x86 server.
+          platforms: linux/amd64,linux/arm64
+          push: true
+          # Four tags: the exact version, the minor line, the major line for
+          # somebody who wants fixes without reading release notes, and latest.
+          # Written without the leading `v`, because an image tag conventionally
+          # carries the version and not the git tag's name for it.
+          tags: |
+            ${{ steps.name.outputs.image }}:${{ needs.plan.outputs.version }}
+            ${{ steps.name.outputs.image }}:${{ needs.plan.outputs.major }}.${{ needs.plan.outputs.minor }}
+            ${{ steps.name.outputs.image }}:${{ needs.plan.outputs.major }}
+            ${{ steps.name.outputs.image }}:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: attest what was built
+        uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1.4.4
+        with:
+          subject-name: ${{ steps.name.outputs.image }}
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true
+
+  package:
+    needs: [plan]
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      # Trusted publishing: PyPI verifies this workflow rather than a token
+      # somebody pasted into a secret and then forgot they had.
+      id-token: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.plan.outputs.tag }}
+      - uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb # v6.1.0
+        with:
+          python-version: "3.12"
+      # The interface is built into the wheel, so `pip install blackboardxray`
+      # gives an application the client and gives an operator the whole server.
+      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          node-version: "24"
+      - run: npm ci --prefix ui && npm run build --prefix ui
+      - run: uv build
+      - name: the interface is in the wheel
+        # It is generated and therefore gitignored, and a build backend that
+        # skips what version control ignores would ship a server serving a
+        # blank page. Checked here rather than discovered by whoever installs.
+        run: |
+          set -euo pipefail
+          wheel=$(ls dist/*.whl)
+          unzip -l "$wheel" > /tmp/wheel.txt
+          grep -q "server/web/index.html" /tmp/wheel.txt
+          echo "the interface is in $wheel"
+      # The twine this bundles has to understand the metadata hatchling writes.
+      # v1.12.2 shipped one that predates Metadata-Version 2.5 and reported the
+      # name as missing from a wheel that plainly has one.
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

blackboardxray-0.1.0/.github/workflows/security.yml

@@ -0,0 +1,92 @@
+# What checks that a dependency has not gone bad, and that the code has not
+# grown a known-shaped hole. Separate from CI because these are slower, and
+# because a scheduled run catches an advisory published after a merge.
+name: security
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Weekly, so an advisory published against an unchanged dependency is found
+    # without waiting for somebody to open a pull request.
+    - cron: "0 6 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  codeql:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, javascript-typescript, actions]
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: github/codeql-action/init@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        with:
+          language: ${{ matrix.language }}
+          queries: security-extended
+      - uses: github/codeql-action/analyze@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        with:
+          category: "/language:${{ matrix.language }}"
+
+  dependency-review:
+    # Only meaningful on a pull request: it compares what a change adds against
+    # what was there before.
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0
+        with:
+          fail-on-severity: high
+          # A copyleft licence arriving through a transitive dependency is a
+          # thing to decide about deliberately rather than discover later.
+          deny-licenses: AGPL-3.0, GPL-2.0, GPL-3.0
+
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb # v6.1.0
+        with:
+          python-version: "3.12"
+      - name: python dependencies
+        run: |
+          uv export --frozen --no-dev --no-emit-project \
+            --format requirements-txt > /tmp/requirements.txt
+          uvx pip-audit --requirement /tmp/requirements.txt --strict
+      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          node-version: "24"
+      - name: interface dependencies
+        working-directory: ui
+        # The interface ships as static files, so a vulnerability in a build
+        # tool is not a vulnerability in what is served. Production
+        # dependencies are the ones that reach a browser.
+        run: npm audit --omit=dev --audit-level=high
+
+  secrets:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      # The binary rather than the action. The action scans the range between
+      # two commits, and on a push that has no base it reports a git error and
+      # exits non zero having found nothing, which is a red build that says
+      # the opposite of what it means. This scans the whole history, once.
+      - name: gitleaks
+        env:
+          VERSION: "8.21.2"
+        run: |
+          curl -sSfL \
+            "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \
+            | tar -xz -C /tmp gitleaks
+          /tmp/gitleaks git . --redact --verbose --exit-code 1