From a9b5277111a8e6d7f754aed054bfc801dc3ede97 Mon Sep 17 00:00:00 2001 From: Paulo Freitas Date: Tue, 22 Sep 2026 16:13:30 -0300 Subject: [PATCH] chore(release): 1.1.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes the [Unreleased] section and moves every copy-paste reference in the documentation to v1.1.0 — the quick start, the examples and the onboarding guide were still teaching v1.0.0. Adds a fourth section to scripts/check-sync.sh so that cannot happen again. The repository already refuses to let the scanner image pin drift from VERSION; the component version in the docs had no such guard, and a release that forgets it leaves the README recommending the previous tag. Only the three forms a reader actually copies are matched — `@vX.Y.Z`, the remote include URL, and the catalog `component@X.Y.Z`. Prose that explains the tagging scheme is illustrative and deliberately not checked. Also corrects the onboarding guide's address. The organization serves Pages from a custom domain, so tooark.github.io is a redirect and https://tooark.com/ci-security-scanner/ is canonical. Co-Authored-By: Claude Opus 5 (1M context) --- .github/ISSUE_TEMPLATE/config.yml | 2 +- .github/workflows/pages.yml | 2 +- CHANGELOG.md | 16 +++++- CONTRIBUTING.md | 4 +- README.md | 10 ++-- README.pt-BR.md | 10 ++-- SUPPORT.md | 4 +- SUPPORTED-INTEGRATIONS.md | 2 +- VERSION | 2 +- docs/index.html | 12 ++-- examples/github/security-scan.yml | 14 ++--- examples/gitlab-catalog-mirror/README.md | 2 +- .../gitlab/catalog-component.gitlab-ci.yml | 6 +- examples/gitlab/remote-include.gitlab-ci.yml | 4 +- scripts/check-sync.sh | 57 ++++++++++++++++++- 15 files changed, 106 insertions(+), 41 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index 940c9dd..f65ff1b 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -6,7 +6,7 @@ contact_links: url: https://github.com/Tooark/ci-security-scanner/security/advisories/new about: Please use private security advisories, not public issues. - name: 📘 Onboarding guide - url: https://tooark.github.io/ci-security-scanner/ + url: https://tooark.com/ci-security-scanner/ about: What each file does and why — read this before filing a usage question. - name: 🐳 Issue in the scanner image itself url: https://github.com/Tooark/base-images/issues/new/choose diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 4389fdb..fecec4f 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -2,7 +2,7 @@ # ci-security-scanner :: GitHub Pages # ----------------------------------------------------------------------------- # Publishes docs/ as the onboarding guide at -# https://tooark.github.io/ci-security-scanner/. +# https://tooark.com/ci-security-scanner/. # # The artifact-based deployment needs Pages switched to the "GitHub Actions" # source once, under Settings > Pages. The API cannot set it, so the first run diff --git a/CHANGELOG.md b/CHANGELOG.md index bb735c0..87ad810 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,8 @@ All notable changes to this project are documented here. The format follows ## [Unreleased] +## [1.1.0] - 2026-09-22 + ### Added - Onboarding guide in `docs/`, deployed to GitHub Pages by @@ -19,6 +21,12 @@ All notable changes to this project are documented here. The format follows scattered across header comments and README gotchas: supported platforms, runners and executors, the component-to-image version pairing, and the network destinations a scan needs. +- `scripts/check-sync.sh` now also verifies that every copy-paste reference in + the README, the examples, the onboarding guide and + `SUPPORTED-INTEGRATIONS.md` pins `COMPONENT_VERSION`. Only the three forms a + reader actually copies are matched; prose explaining the tagging scheme is + not. Without it, a release silently left the quick start teaching the + previous version. ### Changed @@ -32,6 +40,8 @@ All notable changes to this project are documented here. The format follows - This repository's own workflows moved to `actions/checkout@v7`, `actions/configure-pages@v6` and `actions/deploy-pages@v5`. No consumer impact; the runners had started warning that Node 20 is deprecated. +- The GitHub example in `examples/` moved to `actions/checkout@v7`, so a reader + copying it does not start on a version the runner already warns about. ### Fixed @@ -40,6 +50,9 @@ All notable changes to this project are documented here. The format follows `ARK_IN_*` parity check now reads names with `while read` fed by process substitution, which keeps the loop in the current shell so the failure flag survives it. +- The onboarding guide is linked by its canonical address, + `https://tooark.com/ci-security-scanner/`. The `tooark.github.io` URL used + until now is a redirect: the organization serves Pages from a custom domain. ## [1.0.0] - 2026-09-21 @@ -83,5 +96,6 @@ First release. Pins `ghcr.io/tooark/security-scanner:1.9`. socket mount, unredacted Betterleaks output, and Trivy's secret scanner writing findings into an uploaded artifact. -[Unreleased]: https://github.com/Tooark/ci-security-scanner/compare/v1.0.0...HEAD +[Unreleased]: https://github.com/Tooark/ci-security-scanner/compare/v1.1.0...HEAD +[1.1.0]: https://github.com/Tooark/ci-security-scanner/compare/v1.0.0...v1.1.0 [1.0.0]: https://github.com/Tooark/ci-security-scanner/releases/tag/v1.0.0 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index ccbca18..75a22d1 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -9,7 +9,7 @@ GitHub composite Action. Keeping those two front ends interchangeable is the constraint that shapes almost every rule below. If you are new to CI pipelines, read the -[onboarding guide](https://tooark.github.io/ci-security-scanner/) first — it +[onboarding guide](https://tooark.com/ci-security-scanner/) first — it explains what each file does and why. ## Table of contents @@ -137,7 +137,7 @@ The project follows [Semantic Versioning](https://semver.org/). version and the scanner image tag that every template and the Action pin: ```text -COMPONENT_VERSION=1.0.0 +COMPONENT_VERSION=1.1.0 SCANNER_IMAGE=ghcr.io/tooark/security-scanner SCANNER_VERSION=1.9 ``` diff --git a/README.md b/README.md index fd6f49f..aaebe3c 100644 --- a/README.md +++ b/README.md @@ -20,7 +20,7 @@ Input names, defaults and precedence are the same on both sides; only the syntax differs. New to CI pipelines? The -[onboarding guide](https://tooark.github.io/ci-security-scanner/) walks through +[onboarding guide](https://tooark.com/ci-security-scanner/) walks through every file in this repository and the reasoning behind each decision, written for readers who know software development but not CI. Source in [`docs/`](docs/). @@ -57,7 +57,7 @@ Works on gitlab.com and on any instance that can reach ```yaml include: - - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.0.0/templates/full-scan.yml" + - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.1.0/templates/full-scan.yml" inputs: stage: test image: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA" @@ -72,7 +72,7 @@ version to your instance: ```yaml include: - - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/full-scan@1.0.0 + - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/full-scan@1.1.0 inputs: image: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA" trivy_severity: "CRITICAL,HIGH" @@ -85,7 +85,7 @@ include: with: fetch-depth: 0 # Betterleaks needs the full git history -- uses: Tooark/ci-security-scanner@v1.0.0 +- uses: Tooark/ci-security-scanner@v1.1.0 with: command: full-scan image: "myapp:${{ github.sha }}" @@ -263,7 +263,7 @@ never travel as inputs. Pass them as masked CI/CD variables (GitLab) or job ```yaml # GitHub -- uses: Tooark/ci-security-scanner@v1.0.0 +- uses: Tooark/ci-security-scanner@v1.1.0 env: REPORT_TOKEN: ${{ secrets.REPORT_TOKEN }} with: diff --git a/README.pt-BR.md b/README.pt-BR.md index 3ddbdaf..1618c3b 100644 --- a/README.pt-BR.md +++ b/README.pt-BR.md @@ -21,7 +21,7 @@ Nomes de input, defaults e precedência são os mesmos nos dois lados; só a sintaxe muda. Novo em pipelines? O -[guia de onboarding](https://tooark.github.io/ci-security-scanner/) percorre +[guia de onboarding](https://tooark.com/ci-security-scanner/) percorre cada arquivo deste repositório e o porquê de cada decisão, escrito para quem conhece desenvolvimento de software, mas não CI. Fonte em [`docs/`](docs/). @@ -57,7 +57,7 @@ Funciona no gitlab.com e em qualquer instância que alcance ```yaml include: - - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.0.0/templates/full-scan.yml" + - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.1.0/templates/full-scan.yml" inputs: stage: test image: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA" @@ -72,7 +72,7 @@ versão na sua instância: ```yaml include: - - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/full-scan@1.0.0 + - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/full-scan@1.1.0 inputs: image: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA" trivy_severity: "CRITICAL,HIGH" @@ -85,7 +85,7 @@ include: with: fetch-depth: 0 # Betterleaks precisa do history completo -- uses: Tooark/ci-security-scanner@v1.0.0 +- uses: Tooark/ci-security-scanner@v1.1.0 with: command: full-scan image: "myapp:${{ github.sha }}" @@ -263,7 +263,7 @@ ou `env` do job (GitHub) — o repasse para o container é automático: ```yaml # GitHub -- uses: Tooark/ci-security-scanner@v1.0.0 +- uses: Tooark/ci-security-scanner@v1.1.0 env: REPORT_TOKEN: ${{ secrets.REPORT_TOKEN }} with: diff --git a/SUPPORT.md b/SUPPORT.md index 984b1b0..60adc0f 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -8,7 +8,7 @@ This document explains where to get help based on what you're trying to do. ## 🤔 I have a question -**Read the onboarding guide first:** +**Read the onboarding guide first:** It walks the repository file by file — what each artifact does, how the GitHub and GitLab front ends stay interchangeable, and the reasoning behind the @@ -85,7 +85,7 @@ Full policy and response targets are in [`SECURITY.md`](SECURITY.md). | Audience | Start here | | ----------------------- | ------------------------------------------------------------------ | -| **New to CI pipelines** | [Onboarding guide](https://tooark.github.io/ci-security-scanner/) | +| **New to CI pipelines** | [Onboarding guide](https://tooark.com/ci-security-scanner/) | | **Users** | [README.md](README.md) · [README.pt-BR.md](README.pt-BR.md) | | **Every input** | The `spec:inputs` block of each file in [`templates/`](templates/) | | **Support boundaries** | [SUPPORTED-INTEGRATIONS.md](SUPPORTED-INTEGRATIONS.md) | diff --git a/SUPPORTED-INTEGRATIONS.md b/SUPPORTED-INTEGRATIONS.md index d652296..774087a 100644 --- a/SUPPORTED-INTEGRATIONS.md +++ b/SUPPORTED-INTEGRATIONS.md @@ -15,7 +15,7 @@ filled in; the `bug` template asks for exactly the fields this page indexes. | Platform | How it is consumed | Status | | -------------------------------------- | ------------------------------------------- | -------------- | -| **GitHub Actions** | `uses: Tooark/ci-security-scanner@v1.0.0` | ✅ Supported | +| **GitHub Actions** | `uses: Tooark/ci-security-scanner@v1.1.0` | ✅ Supported | | **GitLab CI — remote include** | `include: - remote: ".../templates/*.yml"` | ✅ Supported | | **GitLab CI — CI/CD Catalog** | `include: - component: $CI_SERVER_FQDN/...` | ✅ Supported | | **Direct invocation** | `docker run` / `src/run-scanner.sh` | ⚠️ Best effort | diff --git a/VERSION b/VERSION index 36175ac..d918070 100644 --- a/VERSION +++ b/VERSION @@ -1,6 +1,6 @@ # Single source of truth for versions in this repository. # scripts/check-version-sync.sh enforces that every template and action.yml # pins exactly SCANNER_IMAGE:SCANNER_VERSION. -COMPONENT_VERSION=1.0.0 +COMPONENT_VERSION=1.1.0 SCANNER_IMAGE=ghcr.io/tooark/security-scanner SCANNER_VERSION=1.9 diff --git a/docs/index.html b/docs/index.html index c5d4433..1f76f87 100644 --- a/docs/index.html +++ b/docs/index.html @@ -599,7 +599,7 @@

ci-security-scanner
por dentro

  • Tooark/ci-security-scanner
    • -
  • v1.0.0
    • +
  • v1.1.0
  • scanner 1.9
  • 7 scans
  • 2 plataformas
    • @@ -900,7 +900,7 @@

    A fachada GitHub: action.yml

    - Quando alguém escreve uses: Tooark/ci-security-scanner@v1.0.0, o GitHub baixa este + Quando alguém escreve uses: Tooark/ci-security-scanner@v1.1.0, o GitHub baixa este repositório e executa os passos declarados aqui dentro do job de quem chamou. O arquivo tem quatro blocos.

    @@ -1005,7 +1005,7 @@

    Como se consome

    # no .gitlab-ci.yml do projeto que quer ser escaneado
 include:
-  - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.0.0/templates/full-scan.yml"
+  - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.1.0/templates/full-scan.yml"
     inputs:
       stage: security
       image: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA"
@@ -1065,7 +1065,7 @@ 
    O caminho completo de uma execução
    
           
           1
           workflow do time
-          uses: ...@v1.0.0
+          uses: ...@v1.1.0
           with: command, image
           
 
@@ -1170,7 +1170,7 @@ 
    A solução
    
       
    O VERSION é a constante única:
    
 
 
    # Single source of truth for versions in this repository.
-COMPONENT_VERSION=1.0.0
+COMPONENT_VERSION=1.1.0
 SCANNER_IMAGE=ghcr.io/tooark/security-scanner
 SCANNER_VERSION=1.9
    
 
@@ -1462,7 +1462,7 @@ 
    Por onde começar a ler o código
    
       
 
       
    
-        Guia de onboarding · Tooark/ci-security-scanner v1.0.0 · scanner 1.9
    
+        Guia de onboarding · Tooark/ci-security-scanner v1.1.0 · scanner 1.9
    
         A referência autoritativa de cada input é o bloco spec:inputs do template correspondente.
       
    
     
diff --git a/examples/github/security-scan.yml b/examples/github/security-scan.yml
index 1271b7a..ae56bbf 100644
--- a/examples/github/security-scan.yml
+++ b/examples/github/security-scan.yml
@@ -25,19 +25,19 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # Betterleaks walks the git history; a shallow clone hides most of it.
           fetch-depth: 0
 
       - name: Secret scan
-        uses: Tooark/ci-security-scanner@v1.0.0
+        uses: Tooark/ci-security-scanner@v1.1.0
         with:
           command: secret-scan
           artifact-name: secret-scan-reports
 
       - name: Dockerfile lint
-        uses: Tooark/ci-security-scanner@v1.0.0
+        uses: Tooark/ci-security-scanner@v1.1.0
         with:
           command: dockerfile-lint
           dockerfile: Dockerfile
@@ -52,7 +52,7 @@ jobs:
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -66,7 +66,7 @@ jobs:
 
       - name: Full security scan
         id: scan
-        uses: Tooark/ci-security-scanner@v1.0.0
+        uses: Tooark/ci-security-scanner@v1.1.0
         env:
           # Secrets travel through env, never through inputs.
           REPORT_TOKEN: ${{ secrets.REPORT_TOKEN }}
@@ -97,11 +97,11 @@ jobs:
     name: Advisory scan
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Filesystem scan
         id: fs
-        uses: Tooark/ci-security-scanner@v1.0.0
+        uses: Tooark/ci-security-scanner@v1.1.0
         with:
           command: filesystem-scan
           soft-fail: "true"
diff --git a/examples/gitlab-catalog-mirror/README.md b/examples/gitlab-catalog-mirror/README.md
index 0a431e7..9fd6d86 100644
--- a/examples/gitlab-catalog-mirror/README.md
+++ b/examples/gitlab-catalog-mirror/README.md
@@ -72,7 +72,7 @@ Once the first release lands, projects on the instance include it by path:
 
 ```yaml
 include:
-  - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/full-scan@1.0.0
+  - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/full-scan@1.1.0
     inputs:
       image: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA"
       trivy_severity: "CRITICAL,HIGH"
diff --git a/examples/gitlab/catalog-component.gitlab-ci.yml b/examples/gitlab/catalog-component.gitlab-ci.yml
index faf3ef3..845228f 100644
--- a/examples/gitlab/catalog-component.gitlab-ci.yml
+++ b/examples/gitlab/catalog-component.gitlab-ci.yml
@@ -11,7 +11,7 @@ stages:
 
 include:
   # Full combo on the default branch and on tags.
-  - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/full-scan@1.0.0
+  - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/full-scan@1.1.0
     inputs:
       stage: security
       image: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA"
@@ -23,7 +23,7 @@ include:
         - if: $CI_COMMIT_TAG
 
   # Fast feedback on merge requests: secrets and Dockerfile lint only.
-  - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/secret-scan@1.0.0
+  - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/secret-scan@1.1.0
     inputs:
       job_name: "security:secrets-mr"
       stage: security
@@ -32,7 +32,7 @@ include:
       rules:
         - if: $CI_PIPELINE_SOURCE == "merge_request_event"
 
-  - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/dockerfile-lint@1.0.0
+  - component: $CI_SERVER_FQDN/tooark/ci-security-scanner/dockerfile-lint@1.1.0
     inputs:
       job_name: "security:lint-mr"
       stage: security
diff --git a/examples/gitlab/remote-include.gitlab-ci.yml b/examples/gitlab/remote-include.gitlab-ci.yml
index fe80d88..50138ae 100644
--- a/examples/gitlab/remote-include.gitlab-ci.yml
+++ b/examples/gitlab/remote-include.gitlab-ci.yml
@@ -27,7 +27,7 @@ include:
   # ---------------------------------------------------------------------------
   # Everything at once: image + source + secrets + Dockerfile lint.
   # ---------------------------------------------------------------------------
-  - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.0.0/templates/full-scan.yml"
+  - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.1.0/templates/full-scan.yml"
     inputs:
       stage: security
       image: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA"
@@ -40,7 +40,7 @@ include:
   # ---------------------------------------------------------------------------
   # A second, faster job that runs on merge requests only: secrets, no image.
   # ---------------------------------------------------------------------------
-  - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.0.0/templates/secret-scan.yml"
+  - remote: "https://raw.githubusercontent.com/Tooark/ci-security-scanner/v1.1.0/templates/secret-scan.yml"
     inputs:
       job_name: "security:secrets-mr"
       stage: security
diff --git a/scripts/check-sync.sh b/scripts/check-sync.sh
index 21f2b39..3c7c015 100644
--- a/scripts/check-sync.sh
+++ b/scripts/check-sync.sh
@@ -1,10 +1,11 @@
 #!/usr/bin/env bash
 # =============================================================================
-# Guards the two invariants that keep the GitLab templates and the GitHub
-# Action interchangeable:
+# Guards the invariants that keep the GitLab templates and the GitHub Action
+# interchangeable, and the documentation honest:
 #
 #   1. every artifact pins exactly the scanner image declared in VERSION;
-#   2. every ARK_IN_* an artifact sets is actually consumed downstream.
+#   2. every ARK_IN_* an artifact sets is actually consumed downstream;
+#   3. every copy-paste reference in the docs pins COMPONENT_VERSION.
 #
 # Run it locally with: ./scripts/check-sync.sh
 #
@@ -163,6 +164,56 @@ while read -r name; do
 done < <(grep -oE 'ARK_IN_[A-Z0-9_]+' action.yml | sort -u)
 [ "$action_ok" -eq 1 ] && ok "action.yml -> src/run-scanner.sh"
 
+echo
+echo "4. component version in copy-paste references"
+
+COMPONENT_VERSION="$(version_field COMPONENT_VERSION)"
+
+# Only the three forms a reader copies into their own pipeline. Prose that
+# explains the tagging scheme -- "v1.0.0 is never moved", the table of floating
+# tags -- is illustrative and deliberately not matched.
+VERSION_REF_RE='ci-security-scanner@v[0-9]+\.[0-9]+\.[0-9]+'
+VERSION_REF_RE="$VERSION_REF_RE|ci-security-scanner/v[0-9]+\.[0-9]+\.[0-9]+/"
+VERSION_REF_RE="$VERSION_REF_RE|ci-security-scanner/[a-z-]+@[0-9]+\.[0-9]+\.[0-9]+"
+
+version_ref_files=(
+  README.md
+  README.pt-BR.md
+  SUPPORTED-INTEGRATIONS.md
+  docs/index.html
+  examples/github/security-scan.yml
+  examples/gitlab/catalog-component.gitlab-ci.yml
+  examples/gitlab/remote-include.gitlab-ci.yml
+  examples/gitlab-catalog-mirror/README.md
+)
+
+for file in "${version_ref_files[@]}"; do
+  if [ ! -f "$file" ]; then
+    fail "$file is checked for the component version but does not exist"
+    continue
+  fi
+
+  file_ok=1
+  seen=0
+  while read -r ref; do
+    [ -n "$ref" ] || continue
+    seen=1
+    # Strip a trailing slash first, then everything up to the last @ or / and
+    # an optional v, leaving the bare version.
+    found="$(printf '%s' "$ref" | sed -E 's#/$##; s#.*[@/]v?##')"
+    if [ "$found" != "$COMPONENT_VERSION" ]; then
+      fail "$file pins $found, expected $COMPONENT_VERSION  ($ref)"
+      file_ok=0
+    fi
+  done < <(grep -oE "$VERSION_REF_RE" "$file" | sort -u)
+
+  if [ "$seen" -eq 0 ]; then
+    fail "$file has no component version reference; restore it or drop the file from the list"
+  elif [ "$file_ok" -eq 1 ]; then
+    ok "$file"
+  fi
+done
+
 echo
 if [ "$failures" -gt 0 ]; then
   printf '%s check(s) failed\n' "$failures" >&2