#!/usr/bin/env bash
# Fetch upstream source at pinned commits.
set -euo pipefail

DEST="${1:-./sources}"
mkdir -p "$DEST"

# go-gitea/gitea (MIT)
echo "fetching go-gitea/gitea @ 66546045b5"
curl -sL --max-time 900 -o "$DEST/gitea.tar.gz" \
  "https://codeload.github.com/go-gitea/gitea/tar.gz/66546045b5d533d707a7412dd9fb6be5eacec06b"

# harness/gitness (Apache-2.0)
echo "fetching harness/gitness @ main"
curl -sL --max-time 900 -o "$DEST/gitness.tar.gz" \
  "https://codeload.github.com/harness/gitness/tar.gz/main"

# woodpecker-ci/woodpecker (Apache-2.0)
echo "fetching woodpecker-ci/woodpecker @ 8fcfe04e79"
curl -sL --max-time 900 -o "$DEST/woodpecker.tar.gz" \
  "https://codeload.github.com/woodpecker-ci/woodpecker/tar.gz/8fcfe04e79fee4b63e7c1ad23b3c0171fc6b28cc"

# nektos/act (MIT)
echo "fetching nektos/act @ 4f41128141"
curl -sL --max-time 900 -o "$DEST/act.tar.gz" \
  "https://codeload.github.com/nektos/act/tar.gz/4f411281417e88660bea1c1a1749aa71ae0bd60f"

# semaphoreui/semaphore (MIT)
echo "fetching semaphoreui/semaphore @ 7102353a6f"
curl -sL --max-time 900 -o "$DEST/semaphore.tar.gz" \
  "https://codeload.github.com/semaphoreui/semaphore/tar.gz/7102353a6fb75a5e19dbbeda3f4eb1c929deab11"

# gitleaks/gitleaks (MIT)
echo "fetching gitleaks/gitleaks @ b58d3f102c"
curl -sL --max-time 900 -o "$DEST/gitleaks.tar.gz" \
  "https://codeload.github.com/gitleaks/gitleaks/tar.gz/b58d3f102cf3a2c84cb7f923d05c25c9b1aed84b"

# checkmarx/kics (Apache-2.0)
echo "fetching checkmarx/kics @ 8a0f0bbaf3"
curl -sL --max-time 900 -o "$DEST/kics.tar.gz" \
  "https://codeload.github.com/checkmarx/kics/tar.gz/8a0f0bbaf380c6f9110bfe9808311f49aac45cde"

# aquasecurity/trivy (Apache-2.0)
echo "fetching aquasecurity/trivy @ 8f815546c7"
curl -sL --max-time 900 -o "$DEST/trivy.tar.gz" \
  "https://codeload.github.com/aquasecurity/trivy/tar.gz/8f815546c7b57dc11229b0098463dff0cfc9ed2c"

echo "done -> $DEST"