vpcatlas 0.4.2__tar.gz

vpcatlas-0.4.2/.gitattributes

@@ -0,0 +1,3 @@
+# Every text file is checked out with LF on every system: the bundled viewer is checked against its
+# recorded size and hash, and the exported diagrams are compared byte for byte with the served ones.
+* text=auto eol=lf

vpcatlas-0.4.2/.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Every path is reviewed by the maintainer.
+* @karina-pp

vpcatlas-0.4.2/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,15 @@
+## What and why
+
+<!-- What does this change, and what problem does it solve? Link the issue if there is one. -->
+
+## How it was tested
+
+<!-- Commands you ran (make lint test, pytest -k ..., a scan against a fixture, a build) and what you saw. -->
+
+## Checklist
+
+- [ ] Tests added or updated, and `make lint test` passes.
+- [ ] Documentation updated (README, the matching page in `docs/`) if a command, route, permission or output changed.
+- [ ] `CHANGELOG.md` has an entry under `## [Unreleased]`.
+- [ ] No secrets, real account ids, ARNs or customer names in the diff or in the fixtures (use `111111111111`-style ids).
+- [ ] A new AWS call is read-only and is listed in the auditor policy, in Coverage and in IAM.

vpcatlas-0.4.2/.github/actions/setup/action.yml

@@ -0,0 +1,29 @@
+name: Set up Python and install vpcatlas
+description: Python with a pip cache keyed on pyproject.toml, then vpcatlas installed in editable mode with the chosen extras. The caller checks the code out first.
+
+inputs:
+  python-version:
+    description: Python version to install.
+    required: false
+    default: "3.12"
+  extras:
+    description: Extras of vpcatlas to install, comma separated, for example dev or dev,docs.
+    required: false
+    default: dev
+
+runs:
+  using: composite
+  steps:
+    - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      with:
+        python-version: ${{ inputs.python-version }}
+        cache: pip
+        cache-dependency-path: pyproject.toml
+
+    - name: Install vpcatlas
+      shell: bash
+      env:
+        EXTRAS: ${{ inputs.extras }}
+      run: |
+        python -m pip install --upgrade pip
+        python -m pip install -e ".[${EXTRAS}]"

vpcatlas-0.4.2/.github/dependabot.yml

@@ -0,0 +1,43 @@
+# Weekly update pull requests. Actions and the Docker base images are pinned to digests or commit SHAs, so
+# Dependabot is what keeps them current; each bump arrives as a reviewable diff with the upstream release notes.
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: ci(deps)
+    groups:
+      actions:
+        patterns: ["*"]
+
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: build(deps)
+    groups:
+      python-minor:
+        update-types: [minor, patch]
+
+  - package-ecosystem: docker
+    directory: /deploy
+    schedule:
+      interval: weekly
+      day: monday
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: build(docker)

vpcatlas-0.4.2/.github/workflows/ci.yml

@@ -0,0 +1,552 @@
+name: ci
+
+# Every change runs the same checks a release depends on: lint, types, tests on three systems, the docs, the Python
+# package, both container images and the installers. The job names below are the required checks of the main branch;
+# rename one only together with the branch protection rule.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      # zizmor uploads its findings to the Security tab.
+      security-events: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup # zizmor: ignore[self-repository] actionlint 1.7.12 rejects the $/ syntax
+
+      - name: Lint
+        run: ruff check .
+
+      - name: Check formatting
+        run: ruff format --check .
+
+      # Checks the syntax, the expressions and the shell scripts of every workflow.
+      - name: Check the workflows with actionlint
+        uses: docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
+        with:
+          args: -color
+
+      # Looks for security problems in the workflows (unpinned actions, injectable expressions, wide permissions).
+      # First as a gate: the findings are printed in the log and fail the job.
+      - name: Check the workflows with zizmor
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+        with:
+          advanced-security: false
+
+      # Then again as a report for the Security tab. A pull request from a fork has a read-only token and cannot
+      # upload there, so the report is skipped for it.
+      - name: Report the zizmor findings to the Security tab
+        if: ${{ !cancelled() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+        with:
+          advanced-security: true
+
+  typecheck:
+    name: Type check
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup # zizmor: ignore[self-repository] actionlint 1.7.12 rejects the $/ syntax
+
+      # The configuration lives in pyproject.toml ([tool.mypy]).
+      - name: mypy
+        run: python -m mypy
+
+  test:
+    name: Tests (${{ matrix.os }}, py${{ matrix.python }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Only this leg measures coverage and keeps the report.
+          - { os: ubuntu-latest, python: "3.12", coverage: true }
+          - { os: ubuntu-latest, python: "3.13" }
+          - { os: macos-14, python: "3.12" }
+          - { os: windows-2022, python: "3.12" }
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup # zizmor: ignore[self-repository] actionlint 1.7.12 rejects the $/ syntax
+        with:
+          python-version: ${{ matrix.python }}
+
+      - name: Test
+        if: ${{ !matrix.coverage }}
+        run: pytest
+
+      - name: Test with coverage
+        if: ${{ matrix.coverage }}
+        run: pytest --cov=vpcatlas --cov-report=xml --cov-report=term --cov-fail-under=88
+
+      # The total and the five files with the lowest line coverage, in the summary of the run.
+      - name: Coverage summary
+        if: ${{ always() && matrix.coverage }}
+        run: |
+          python - <<'PY'
+          import os
+          import xml.etree.ElementTree as ET
+
+          if not os.path.exists("coverage.xml"):
+              raise SystemExit("coverage.xml was not written")
+          root = ET.parse("coverage.xml").getroot()
+          rows = []
+          for cls in root.iter("class"):
+              lines = cls.findall("./lines/line")
+              if not lines:
+                  continue
+              hit = sum(1 for line in lines if int(line.get("hits", "0")) > 0)
+              rows.append((hit / len(lines), len(lines) - hit, cls.get("filename", "?")))
+          rows.sort(key=lambda row: (row[0], -row[1], row[2]))
+          total = float(root.get("line-rate", "0")) * 100
+          out = ["## Coverage", "", f"Total line coverage: **{total:.1f}%** (the gate is 88%)", ""]
+          out += ["Five least covered files:", "", "| File | Covered | Lines missed |", "|---|---:|---:|"]
+          out += [f"| `{name}` | {rate * 100:.1f}% | {missed} |" for rate, missed, name in rows[:5]]
+          with open(os.environ["GITHUB_STEP_SUMMARY"], "a", encoding="utf-8") as summary:
+              summary.write("\n".join(out) + "\n")
+          PY
+
+      - name: Keep the coverage report
+        if: ${{ always() && matrix.coverage }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: coverage-xml
+          path: coverage.xml
+          if-no-files-found: ignore
+
+  docs:
+    name: Docs
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup # zizmor: ignore[self-repository] actionlint 1.7.12 rejects the $/ syntax
+        with:
+          extras: docs
+
+      # --strict turns every broken link and every warning into an error.
+      - name: Build the site
+        run: mkdocs build --strict
+
+      - name: Keep the site
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: docs-site
+          path: site/
+          retention-days: 3
+          if-no-files-found: error
+
+  package:
+    name: Python package
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      # The same steps as the package job of the release workflow, so a broken package shows up before the tag.
+      - name: Build the sdist and the wheel
+        run: |
+          python -m pip install --require-hashes -r requirements-release.lock
+          python -m build --no-isolation
+          twine check dist/*
+
+      - name: The wheel carries the dashboard
+        run: |
+          wheels=(dist/*.whl)
+          wheel="${wheels[0]}"
+          for file in dashboard/templates/index.html dashboard/static/app.js auditor-policy.json; do
+            unzip -l "$wheel" | grep -q "vpcatlas/${file}" || { echo "${file} is missing from ${wheel}" >&2; exit 1; }
+          done
+
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: python-dist
+          path: dist/
+          retention-days: 3
+          if-no-files-found: error
+
+  images:
+    name: Images
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    permissions:
+      contents: read
+      # The Trivy report is uploaded to the Security tab.
+      security-events: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+
+      - name: Build the dashboard image
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          file: deploy/Dockerfile
+          load: true
+          push: false
+          tags: vpcatlas:ci
+          cache-from: type=gha,scope=dashboard
+          cache-to: type=gha,scope=dashboard,mode=max
+
+      - name: Smoke test the dashboard image
+        run: |
+          docker run -d --name atlas -p 8080:8080 -e AWS_EC2_METADATA_DISABLED=true vpcatlas:ci
+          for _ in $(seq 1 30); do
+            if curl -fsS http://127.0.0.1:8080/healthz > /dev/null; then break; fi
+            sleep 2
+          done
+          curl -fsS http://127.0.0.1:8080/healthz
+          echo
+          curl -fsS http://127.0.0.1:8080/ | grep -q "VPC Atlas"
+          curl -fsS http://127.0.0.1:8080/static/app.js > /dev/null
+          docker exec atlas python -m vpcatlas.dashboard.healthcheck
+          docker exec atlas vpcatlas --help > /dev/null
+
+      - name: Container logs
+        if: always()
+        run: docker logs atlas || true
+
+      - name: Build the Lambda image
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          file: deploy/Dockerfile.lambda
+          load: true
+          push: false
+          tags: vpcatlas-lambda:ci
+          cache-from: type=gha,scope=lambda
+          cache-to: type=gha,scope=lambda,mode=max
+
+      # The Lambda base image carries the Runtime Interface Emulator: it listens on port 8080 and runs the handler
+      # for every POST to /2015-03-31/functions/function/invocations. The event is what API Gateway (HTTP API v2)
+      # sends for GET /healthz.
+      - name: Smoke test the Lambda image
+        run: |
+          docker run -d --name lambda -p 9009:8080 vpcatlas-lambda:ci
+          event="${RUNNER_TEMP}/event.json"
+          out="${RUNNER_TEMP}/lambda-response.json"
+          cat > "$event" <<'JSON'
+          {"version":"2.0","routeKey":"GET /healthz","rawPath":"/healthz","rawQueryString":"","headers":{"host":"localhost","accept":"*/*"},"requestContext":{"accountId":"000000000000","apiId":"local","domainName":"localhost","http":{"method":"GET","path":"/healthz","protocol":"HTTP/1.1","sourceIp":"127.0.0.1","userAgent":"ci"},"requestId":"ci","routeKey":"GET /healthz","stage":"$default","time":"18/Oct/2026:00:00:00 +0000","timeEpoch":0},"isBase64Encoded":false}
+          JSON
+          for _ in $(seq 1 30); do
+            if curl -sS --max-time 30 -X POST "http://127.0.0.1:9009/2015-03-31/functions/function/invocations" -d "@${event}" -o "$out"; then break; fi
+            sleep 2
+          done
+          cat "$out"
+          echo
+          python3 -c 'import json, sys; sys.exit(0 if json.load(open(sys.argv[1])).get("statusCode") == 200 else 1)' "$out" ||
+            { echo "The Lambda handler did not answer with statusCode 200" >&2; exit 1; }
+
+      - name: Lambda container logs
+        if: failure()
+        run: docker logs lambda || true
+
+      # The report goes to the Security tab; this run never fails on it (the gate is the next-but-two step).
+      - name: Scan the dashboard image with Trivy
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          image-ref: vpcatlas:ci
+          format: sarif
+          output: trivy.sarif
+          severity: CRITICAL,HIGH
+          limit-severities-for-sarif: true
+          ignore-unfixed: true
+          exit-code: "0"
+
+      # A pull request from a fork has a read-only token and cannot upload.
+      - name: Upload the Trivy report
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        with:
+          sarif_file: trivy.sarif
+          category: trivy-dashboard
+
+      - name: Image summary
+        if: always()
+        run: |
+          python3 - <<'PY'
+          import json
+          import os
+          import subprocess
+
+
+          def size_mb(image):
+              try:
+                  raw = subprocess.run(
+                      ["docker", "image", "inspect", "--format", "{{.Size}}", image],
+                      check=True,
+                      capture_output=True,
+                      text=True,
+                  ).stdout.strip()
+                  return f"{int(raw) / 1_000_000:.1f} MB"
+              except (subprocess.CalledProcessError, ValueError):
+                  return "not built"
+
+
+          counts = {"CRITICAL": 0, "HIGH": 0}
+          scanned = os.path.exists("trivy.sarif")
+          if scanned:
+              with open("trivy.sarif", encoding="utf-8") as handle:
+                  report = json.load(handle)
+              for run in report.get("runs", []):
+                  rules = {
+                      rule.get("id"): rule.get("properties", {}).get("security-severity")
+                      for rule in run.get("tool", {}).get("driver", {}).get("rules", [])
+                  }
+                  for result in run.get("results", []):
+                      try:
+                          score = float(rules.get(result.get("ruleId")) or 0)
+                      except ValueError:
+                          score = 0.0
+                      counts["CRITICAL" if score >= 9.0 else "HIGH"] += 1
+          out = ["## Images", "", "| Image | Size |", "|---|---:|"]
+          out += [f"| dashboard (`vpcatlas:ci`) | {size_mb('vpcatlas:ci')} |"]
+          out += [f"| Lambda (`vpcatlas-lambda:ci`) | {size_mb('vpcatlas-lambda:ci')} |", ""]
+          if scanned:
+              out += ["Trivy, dashboard image, fixed vulnerabilities only:", ""]
+              out += ["| Severity | Findings |", "|---|---:|"]
+              out += [f"| CRITICAL | {counts['CRITICAL']} |", f"| HIGH | {counts['HIGH']} |"]
+          else:
+              out += ["Trivy report not written."]
+          with open(os.environ["GITHUB_STEP_SUMMARY"], "a", encoding="utf-8") as summary:
+              summary.write("\n".join(out) + "\n")
+          PY
+
+      # The gate: a critical vulnerability with a fix available fails the job.
+      - name: Gate on critical vulnerabilities
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          image-ref: vpcatlas:ci
+          format: table
+          severity: CRITICAL
+          ignore-unfixed: true
+          exit-code: "1"
+
+      - name: Gate on critical vulnerabilities (Lambda image)
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          image-ref: vpcatlas-lambda:ci
+          format: table
+          severity: CRITICAL
+          ignore-unfixed: true
+          exit-code: "1"
+
+  installer:
+    name: Installer on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-2022, ubuntu-22.04, macos-14]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      # Builds the archive (a .zip on Windows, a .tar.gz elsewhere) and runs the program inside it (--version,
+      # serve --help, a real dashboard request).
+      - name: Build the archive
+        shell: bash
+        run: bash scripts/build-binary.sh
+
+      # Windows PowerShell 5.1, with the script run as text, the way `irm <url> | iex` runs it. The archive and its
+      # checksum come from dist/ instead of the network.
+      - name: Install through a pipe with Windows PowerShell
+        if: matrix.os == 'windows-2022'
+        shell: powershell
+        run: |
+          $ErrorActionPreference = "Stop"
+          $env:VPCATLAS_ARCHIVE = (Get-ChildItem dist/vpcatlas-*.zip).FullName
+          $env:VPCATLAS_SUMS = "$env:VPCATLAS_ARCHIVE.sha256"
+          Get-Content -Raw scripts/install.ps1 | Invoke-Expression
+          vpcatlas --version
+
+      - name: The shim and the persistent PATH work from a new PowerShell
+        if: matrix.os == 'windows-2022'
+        shell: pwsh
+        run: |
+          $p = [Environment]::GetEnvironmentVariable('Path', 'User')
+          $env:Path = "$p;$env:Path"
+          vpcatlas --version
+          vpcatlas serve --help | Out-Null
+
+      - name: The shim works from cmd.exe
+        if: matrix.os == 'windows-2022'
+        # The point of the step is cmd.exe itself: users run the shim from it.
+        shell: cmd # zizmor: ignore[misfeature]
+        run: |
+          set "PATH=%LOCALAPPDATA%\Programs\vpcatlas;%PATH%"
+          vpcatlas --version
+
+      - name: Install as a file with parameters into other directories
+        if: matrix.os == 'windows-2022'
+        shell: pwsh
+        run: |
+          $zip = (Get-ChildItem dist/vpcatlas-*.zip).FullName
+          ./scripts/install.ps1 -Archive $zip -Sums "$zip.sha256" -InstallDir "$env:RUNNER_TEMP\vpcatlas-bin" -DataDir "$env:RUNNER_TEMP\vpcatlas-home"
+          & "$env:RUNNER_TEMP\vpcatlas-bin\vpcatlas.cmd" --version
+
+      # Negative control: the same archive with a checksum file that does not match it. The installer has to stop with
+      # a checksum error and leave nothing in either directory.
+      - name: The installer refuses a wrong checksum
+        if: matrix.os == 'windows-2022'
+        shell: pwsh
+        run: |
+          $zip = (Get-ChildItem dist/vpcatlas-*.zip).FullName
+          $badSums = Join-Path $env:RUNNER_TEMP 'bad-SHA256SUMS'
+          $badBin = "$env:RUNNER_TEMP\bad-bin"
+          $badHome = "$env:RUNNER_TEMP\bad-home"
+          Set-Content -LiteralPath $badSums -Value (('0' * 64) + '  ' + [IO.Path]::GetFileName($zip))
+          $message = $null
+          try {
+            ./scripts/install.ps1 -Archive $zip -Sums $badSums -InstallDir $badBin -DataDir $badHome
+          } catch {
+            $message = $_.Exception.Message
+          }
+          if (-not $message) { throw 'The installer accepted a wrong checksum: no error was raised.' }
+          if ($message -notmatch 'checksum mismatch') { throw "The installer failed, but not on the checksum: $message" }
+          foreach ($dir in @($badBin, $badHome)) {
+            if (Test-Path -LiteralPath $dir) {
+              $left = @(Get-ChildItem -LiteralPath $dir -Recurse -Force | Where-Object { ($_.PSIsContainer -and $_.Name -match '^\d+\.\d+\.\d+') -or $_.Name -eq 'vpcatlas.cmd' })
+              if ($left.Count -gt 0) { throw "The installer left files behind after a wrong checksum: $($left.FullName -join ', ')" }
+            }
+          }
+          Write-Host "Refused as expected: $message"
+
+      - name: Keep the Windows archive
+        if: matrix.os == 'windows-2022'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: windows-x86_64-zip
+          path: |
+            dist/vpcatlas-*.zip
+            dist/vpcatlas-*.zip.sha256
+          retention-days: 3
+          if-no-files-found: error
+
+      # The script is piped into sh, the way `curl -fsSL https://vpcatlas.com/install.sh | sh` runs it, with the
+      # default directories. The archive and its checksum come from dist/ instead of the network.
+      - name: Install through a pipe with sh
+        if: matrix.os != 'windows-2022'
+        shell: bash
+        run: |
+          archives=("$PWD"/dist/vpcatlas-*.tar.gz)
+          [ "${#archives[@]}" -eq 1 ] || { echo "expected one archive in dist/, found ${#archives[@]}" >&2; exit 1; }
+          export VPCATLAS_ARCHIVE="${archives[0]}"
+          export VPCATLAS_SUMS="${VPCATLAS_ARCHIVE}.sha256"
+          # The pipe is the point of this step, so the useless-cat warning does not apply.
+          # shellcheck disable=SC2002
+          cat scripts/install.sh | sh
+          # The script put the link in /usr/local/bin or in ~/.local/bin; a new shell would find it there.
+          export PATH="$HOME/.local/bin:/usr/local/bin:$PATH"
+          version="$(basename "$VPCATLAS_ARCHIVE" | sed -n 's/^vpcatlas-\(.*\)-[a-z]*-[a-z0-9_]*\.tar\.gz$/\1/p')"
+          [ -n "$version" ] || { echo "could not read the version from $VPCATLAS_ARCHIVE" >&2; exit 1; }
+          link="$(command -v vpcatlas)"
+          echo "link: ${link} -> $(readlink "$link")"
+          [ -L "$link" ] || { echo "${link} is not a symbolic link" >&2; exit 1; }
+          vpcatlas --version | grep -F "$version"
+          vpcatlas serve --help > /dev/null
+
+      - name: Install into other directories
+        if: matrix.os != 'windows-2022'
+        shell: bash
+        run: |
+          archives=("$PWD"/dist/vpcatlas-*.tar.gz)
+          export VPCATLAS_ARCHIVE="${archives[0]}"
+          export VPCATLAS_SUMS="${VPCATLAS_ARCHIVE}.sha256"
+          export VPCATLAS_INSTALL_DIR="${RUNNER_TEMP}/vpcatlas-bin"
+          export VPCATLAS_HOME="${RUNNER_TEMP}/vpcatlas-home"
+          sh scripts/install.sh
+          [ -L "${VPCATLAS_INSTALL_DIR}/vpcatlas" ] || { echo "no link in ${VPCATLAS_INSTALL_DIR}" >&2; exit 1; }
+          "${VPCATLAS_INSTALL_DIR}/vpcatlas" --version
+          [ -n "$(find "$VPCATLAS_HOME" -mindepth 2 -maxdepth 2 -name _internal)" ] ||
+            { echo "no installed folder in ${VPCATLAS_HOME}" >&2; exit 1; }
+
+      # Negative control: the same archive with a checksum file that does not match it. The installer has to stop
+      # with a checksum error and leave nothing in either directory.
+      - name: The installer refuses a wrong checksum
+        if: matrix.os != 'windows-2022'
+        shell: bash
+        run: |
+          archives=("$PWD"/dist/vpcatlas-*.tar.gz)
+          export VPCATLAS_ARCHIVE="${archives[0]}"
+          export VPCATLAS_SUMS="${RUNNER_TEMP}/bad-SHA256SUMS"
+          export VPCATLAS_INSTALL_DIR="${RUNNER_TEMP}/bad-bin"
+          export VPCATLAS_HOME="${RUNNER_TEMP}/bad-home"
+          printf '%s  %s\n' "0000000000000000000000000000000000000000000000000000000000000000" "$(basename "$VPCATLAS_ARCHIVE")" > "$VPCATLAS_SUMS"
+          status=0
+          output="$(sh scripts/install.sh 2>&1)" || status=$?
+          echo "$output"
+          [ "$status" -ne 0 ] || { echo "The installer accepted a wrong checksum" >&2; exit 1; }
+          echo "$output" | grep -q "checksum mismatch" || { echo "The installer failed, but not on the checksum" >&2; exit 1; }
+          if [ -e "${VPCATLAS_INSTALL_DIR}/vpcatlas" ] || [ -L "${VPCATLAS_INSTALL_DIR}/vpcatlas" ]; then
+            echo "The installer left a link behind after a wrong checksum" >&2
+            exit 1
+          fi
+          if [ -d "$VPCATLAS_HOME" ] && [ -n "$(find "$VPCATLAS_HOME" -mindepth 1)" ]; then
+            echo "The installer left files behind after a wrong checksum" >&2
+            exit 1
+          fi
+          echo "Refused as expected"
+
+  dependency-review:
+    name: Dependency review
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      # The summary is posted as a comment on the pull request.
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: high
+          comment-summary-in-pr: on-failure