#!/usr/bin/env bash
# One-shot bootstrap of the gitleaks binary into ~/.local/bin (pinned version).
# Reproducible: fixed tag, not "latest". Bump GL_VER deliberately to upgrade.
set -eu
GL_VER="8.30.1"
DEST="${HOME}/.local/bin"
mkdir -p "$DEST"
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT
URL="https://github.com/gitleaks/gitleaks/releases/download/v${GL_VER}/gitleaks_${GL_VER}_linux_x64.tar.gz"
echo "[bootstrap] fetching gitleaks v${GL_VER}"
curl -sSL -m 180 -o "$tmp/gl.tgz" "$URL"
tar xzf "$tmp/gl.tgz" -C "$tmp" gitleaks
install -m0755 "$tmp/gitleaks" "${DEST}/gitleaks"
echo "[bootstrap] installed: $("$DEST/gitleaks" version) → ${DEST}/gitleaks"
echo "[bootstrap] ensure PATH includes ${DEST}, e.g. in your shell rc:
  export PATH=\"${DEST}:\$PATH\""