platform-ci/source_tools/tools.env

# Pinned third-party tool downloads used by the shared CI. Sourced by scripts.
# The checksums were read from the upstream release over HTTPS (same origin as
# the binary, so trust-on-first-use): cross-check them against an independent
# source before the first publish. A tool without a checksum fails closed.
NODE_VERSION=22.20.0
NODE_LINUX_X64_SHA256=eeaccb0378b79406f2208e8b37a62479c70595e20be6b659125eb77dd1ab2a29
# Node 24 for the plain node profile (node-version: 24): official linux-x64 tarball, installed by install-tool.sh node24 into a job temp dir.
NODE24_VERSION=24.22.2
NODE24_LINUX_X64_SHA256=361718c444e49af2ca5a110c83ba6a8901143f23ab285ebbef0341f391f482a9
# Manifest rendering. kubectl v1.36.1 embeds Kustomize v5.8.1 (`kubectl kustomize`); no cluster is contacted.
# Both checksums were fetched from the vendor (dl.k8s.io kubectl.sha256, get.helm.sh .sha256sum) and
# re-verified against the downloaded bytes on 2026-11-01. Helm is installed only when a caller declares
# enable-helm; it is unqualified (no current root uses helmCharts).
KUBECTL_VERSION=1.36.1
KUBECTL_LINUX_X64_SHA256=629d3f410e09bf49b64ae7079f7f0bda1191efed311f7d37fdbab0ad5b0ec2b7
HELM_VERSION=4.3.1
HELM_LINUX_X64_SHA256=0403a88ae20913d11b10a2467b50087721fea7581736da6b9d3992f5357fe54b
# Authentik blueprint lint (central linter). PyYAML is installed from this pinned sdist, never by pip.
# PYYAML_SDIST_SHA256 is intentionally EMPTY: it could not be fetched offline and must not be invented, so
# install-tool.sh pyyaml fails closed ("no pinned checksum") and blueprint-lint cannot be enabled until it is
# filled from https://pypi.org/pypi/PyYAML/6.0.2/json (urls[].digests.sha256 of the sdist) and cross-checked.
PYYAML_VERSION=6.0.2
PYYAML_SDIST_SHA256=d584d9ec91ad65861cc08d42e834324ef890a082e591037abe114850ff7bbc3e
# Report-only analysis tools (versions from the orb scripts; semgrep was unpinned there).
SEMGREP_VERSION=1.183.0
OWASP_DEPENDENCY_CHECK_VERSION=12.1.0
CYCLONEDX_VERSION=2.9.1
GITLEAKS_VERSION=8.21.2
GITLEAKS_LINUX_X64_SHA256=5bc41815076e6ed6ef8fbecc9d9b75bcae31f39029ceb55da08086315316e3ba
# Image vulnerability scan + SBOM (image-build). Same release and checksum as the qualified nuncio-container path;
# the checksum is pinned here, so the download fails closed on any mismatch.
TRIVY_VERSION=0.76.1
TRIVY_LINUX_X64_SHA256=c7cbe3137fb8a48a17574bede3dd6beb16742d1e9772929940fc90082c39d9c0
# Linux language profiles (go, python, nix). Versions and checksums were read from the vendors over HTTPS on
# 2026-11-01 (golangci-lint release checksums file, PyPI JSON, Docker Hub tag listing, Go module proxy): same
# trust-on-first-use caveat as above, cross-check independently before the first live use.
# golangci-lint is a checksum-verified binary. go-test-coverage runs through `go run <module>@v<version>`, so the Go
# module proxy and checksum database verify it. ruff is installed from PyPI by exact version (no hash pin: wheels are
# platform specific), into a throw-away venv. NIX_IMAGE_VERSION is the nixos/nix tag the nix profiles run in.
GOLANGCI_LINT_VERSION=2.15.0
GOLANGCI_LINT_LINUX_X64_SHA256=9b7fe6a6bf6334b98decf8d86b11415ea7889afdabdd1959fdce23af2a9ebcea
GO_TEST_COVERAGE_VERSION=2.18.8
RUFF_VERSION=0.17.3
NIX_IMAGE_VERSION=2.35.4
# actionlint for the optional legacy source gate (source-config actionlint=true). Official rhysd/actionlint v1.7.7 linux-amd64 release
# archive, the same program version the original `go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7` gate ran. The checksum was
# computed from the downloaded archive bytes on 2026-11-01 and matches the release's actionlint_1.7.7_checksums.txt.
ACTIONLINT_VERSION=1.7.7
ACTIONLINT_LINUX_X64_SHA256=023070a287cd8cccd71515fedc843f1985bf96c436b7effaecce67290e7e0757
# Git LFS for the native macOS runner (swift-verify). Official git-lfs/git-lfs release v3.7.1, darwin-arm64 zip. The checksum is the
# vendor's own line from the release asset sha256sums.asc (PGP-signed by the project), and was re-verified against the downloaded zip on
# 2026-11-01. install-tool.sh git-lfs installs it only into a caller-supplied job temp directory, on Darwin arm64 only.
GIT_LFS_VERSION=3.7.1
GIT_LFS_DARWIN_ARM64_SHA256=76260fb34f4ee622ff0a66b857e5954aa49c7e343a92e57a1ec4a760618c94b2
# Exact .NET SDKs for dotnet exact-sdk: SHA-512 from Microsoft's official release metadata (releases.json), verified against a download.
DOTNET_SDK_10_0_401_WIN_X64_SHA512=24b670ad3d923bfcf47df6c3b034152398b42f6dbc388e10d783aee1cfb5e5817d399fc0ae2a12cfa822a55e61d34830ccb15c50ef6efee437ab874bb7c79430

# Nonroot writable-store runtime qualified for the existing Nix CI jobs.
NIX_RUNTIME_IMAGE=git.kof22.com/koftwentytwo/ci-nix-runtime@sha256:3b62443b4df1c9e73827a20307b9900159eebb005901e8510b0bf9e12a2d55e1
# SwiftLint for the swift `make` mode (kof22-post `make lint`). The portable macOS zip; the version and checksum are the
# ones the repository's original ci.yml pinned. Installed into a job temp directory only, never onto the host.
SWIFTLINT_VERSION=0.65.1
SWIFTLINT_DARWIN_SHA256=c1e429b0599cf1b516f369a2d9ec04eaf0e436f3c12b637df8851fa52ff694d0

# Browser toolchain images (immutable). JAVA_BROWSER_IMAGE is the operator-preloaded content tag of the verified OCI
# manifest (images/java-browser); once that exact archive is pushed to the private forge, replace it with
# git.kof22.com/<owner>/<name>@sha256:<same manifest digest>. PLAYWRIGHT_IMAGE is the public digest to mirror there.
JAVA_BROWSER_IMAGE=local/java-browser:298bba0a82d7b62237dbcd15e6c876c4d4bb68a575ee6f47dedeeb5591f5e7f0
PLAYWRIGHT_IMAGE=mcr.microsoft.com/playwright@sha256:06a9939e57531807f8d5fd76ce44b53165ffb7d7501d87ab10e285c20b1e971f
NODE_IMAGE=node:22.20.0-bookworm@sha256:915acd9e9b885ead0c620e27e37c81b74c226e0e1c8177f37a60217b6eabb0d7

# Existing release packaging, run unpublished. GORELEASER_VERSION is the version license-tool's release.yml pinned; it runs
# through `go run github.com/goreleaser/goreleaser/v2@v<version>` (module proxy + checksum database verify it), only with
# --snapshot, so nothing is published. CARGO_AUDIT_VERSION is the crates.io release current on 2026-11-01 (kfmtbox's legacy
# job installed it unpinned); `cargo install --locked --version` is verified by the crates.io index checksums.
GORELEASER_VERSION=2.16.0
# Tag release builds run the official prebuilt Linux amd64 binary (what the old goreleaser-action ran), not `go run`: compiling v2.16.0 from
# source fails on grpc@v1.80.0 (undefined http2.TrailerPrefix). The checksum is the release's own checksums.txt line for goreleaser_Linux_x86_64.tar.gz.
GORELEASER_LINUX_X64_SHA256=eaae05b5eba07533bd0f06846b68c808399504784df00c62eb219541fc04e5e2
CARGO_AUDIT_VERSION=0.22.2
# CARGO_DENY_VERSION (notion-sql's cargo-deny-action ran the floating latest) is the crates.io release current on 2026-11-01;
# CARGO_DIST_VERSION is the cargo-dist-version notion-sql's Cargo.toml declares (crates.io 0.32.0, not yanked, binary `dist`).
# Both install with `cargo install --locked --version`, so no archive checksum is pinned or invented.
CARGO_DENY_VERSION=0.20.2
CARGO_DIST_VERSION=0.32.0

# Job-local Go for the native Windows branch build when the service account has no Go on PATH (build-artifacts.ps1 go-branch).
# license-tool's legacy CI used Go 1.26. The zip and checksum are the go.dev/dl entry (https://go.dev/dl/?mode=json&include=all,
# file go1.26.2.windows-amd64.zip, kind archive) read on 2026-11-01; the zip is verified before it is extracted.
GO_WINDOWS_VERSION=1.26.2
GO_WINDOWS_AMD64_SHA256=98eb3570bade15cb826b0909338df6cc6d2cf590bc39c471142002db3832b708

# Job-local rustup for the native Windows rust-release build when the service account has no rustup on PATH (build-artifacts.ps1).
# The checksum is the rustup project's own file https://static.rust-lang.org/rustup/archive/1.29.2/x86_64-pc-windows-msvc/rustup-init.exe.sha256
# (read 2026-11-01); the downloaded rustup-init.exe hashed to the same value and is verified again before it is run.
RUSTUP_WINDOWS_VERSION=1.29.2
RUSTUP_WINDOWS_AMD64_SHA256=00f139da614dced87d3c3d4121c43eebdac3c1bf8a5ee86b9d80dfd71c8d70fd

# Job-local MinGW-w64 for the declared x86_64-pc-windows-gnu release target when gcc.exe and dlltool.exe are not on PATH
# (build-artifacts.ps1). WinLibs (Brecht Sanders, listed on mingw-w64.org) release 16.2.0posix-23.1.3-14.0.0-ucrt-r3, the x86_64 posix-seh
# UCRT zip without LLVM: GCC 16.2.0, Binutils 2.47 (gcc.exe, dlltool.exe, ld.exe, as.exe), MinGW-w64 14.0.0. The checksum is the maintainer's
# own <zip>.sha256 asset; GitHub's independently computed release asset digest and the downloaded bytes gave the same value on 2026-11-01.
MINGW_WINDOWS_RELEASE=16.2.0posix-23.1.3-14.0.0-ucrt-r3
MINGW_WINDOWS_AMD64_ZIP=winlibs-x86_64-posix-seh-gcc-16.2.0-mingw-w64ucrt-14.0.0-r3.zip
MINGW_WINDOWS_AMD64_SHA256=3c69305081e4a647144339a936244fcf7d3d9e558319e1ad7be2cd2886d4b6a1

# Optional source checks (source-verify checks=...): the tools the old orb CI jobs needed, installed only into a job temp dir.
# yq is the version the old Munitor test job pinned (v4.44.6): the official linux_amd64 binary; the checksum matches the SHA-256 column of the
# release's `checksums` file. Bats is the old job's v1.11.1 tag (GitHub tag archive; run in place, no install.sh); the checksum was computed from the
# downloaded archive on 2026-11-02 (trust on first use). ShellCheck 0.8.0 is the official linux.x86_64 release (Ubuntu 22.04's package version, the
# one the old `apt-get install shellcheck` step is believed to have resolved on cimg/node:22.12; NOT proven, so no parity claim; the checksum was
# computed from the downloaded archive on 2026-11-02, trust on first use). envsubst is the Ubuntu jammy gettext-base .deb extracted with
# dpkg-deb into the temp dir (the old step apt-installed gettext-base); the checksum is the SHA256 of the jammy Packages index and matches the download.
YQ_VERSION=4.44.6
YQ_LINUX_X64_SHA256=0c2b24e645b57d8e7c0566d18643a6d4f5580feeea3878127354a46f2a1e4598
# jq for the make-bats check: Munitor's public allocate_version test calls jq against a mock GitHub API, and the job image (node:22.20.0-bookworm)
# has no jq. Official jqlang 1.8.1 linux-amd64 binary; the checksum is the release's own sha256sum.txt line and matches the downloaded bytes.
JQ_VERSION=1.8.1
JQ_LINUX_X64_SHA256=020468de7539ce70ef1bceaf7cde2e8c4f2ca6c3afb84642aabc5c97d9fc2a0d
BATS_VERSION=1.11.1
BATS_SHA256=5c57ed9616b78f7fd8c553b9bae3c7c9870119edd727ec17dbd1185c599f79d9
SHELLCHECK_VERSION=0.8.0
SHELLCHECK_LINUX_X64_SHA256=ab6ee1b178f014d1b86d1e24da20d1139656c8b0ed34d2867fbb834dad02bf0a
GETTEXT_BASE_DEB=gettext-base_0.21-4ubuntu4_amd64.deb
GETTEXT_BASE_DEB_SHA256=9a4971de9bd0ab746cfa7c018d88854da45bcc32dfb654ef9280b90b4445b3f3