feat(container): auto-install gitleaks in generated docker image

Author: skulidropek

packages/docker-git/tests/core/templates.test.ts

@@ -64,6 +64,7 @@ describe("planFiles", () => {
         expect(dockerfileSpec.contents).toContain("AUTO_MENU")
         expect(dockerfileSpec.contents).toContain("ncurses-term")
         expect(dockerfileSpec.contents).toContain("tag-order builtins commands")
+        expect(dockerfileSpec.contents).toContain("gitleaks version")
       }
 
       if (entrypointSpec && entrypointSpec._tag === "File") {

packages/lib/src/core/templates/dockerfile.ts

@@ -46,6 +46,21 @@ RUN curl -fsSL https://opencode.ai/install | HOME=/usr/local bash -s -- --no-mod
 RUN ln -sf /usr/local/.opencode/bin/opencode /usr/local/bin/opencode
 RUN opencode --version`
 
+const gitleaksVersion = "8.28.0"
+
+const renderDockerfileGitleaks = (): string =>
+  `# Tooling: gitleaks (secret scanner for .knowledge/.knowlenge hooks)
+RUN ARCH="$(uname -m)" \
+  && case "$ARCH" in \
+      x86_64|amd64) GITLEAKS_ARCH="x64" ;; \
+      aarch64|arm64) GITLEAKS_ARCH="arm64" ;; \
+      *) echo "Unsupported arch for gitleaks: $ARCH" >&2; exit 1 ;; \
+    esac \
+  && curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${gitleaksVersion}/gitleaks_${gitleaksVersion}_linux_$GITLEAKS_ARCH.tar.gz" \
+    | tar -xz -C /usr/local/bin gitleaks \
+  && chmod +x /usr/local/bin/gitleaks \
+  && gitleaks version`
+
 const dockerfilePlaywrightMcpBlock = String.raw`RUN npm install -g @playwright/mcp@latest
 
 # docker-git: wrapper that converts a CDP HTTP endpoint into a usable WS endpoint
@@ -157,6 +172,7 @@ export const renderDockerfile = (config: TemplateConfig): string =>
     renderDockerfileNode(),
     renderDockerfileBun(config),
     renderDockerfileOpenCode(),
+    renderDockerfileGitleaks(),
     renderDockerfileUsers(config),
     renderDockerfileWorkspace(config)
   ].join("\n\n")

packages/lib/tests/usecases/prepare-files.test.ts

@@ -105,6 +105,7 @@ describe("prepareProjectFiles", () => {
         const entrypoint = yield* _(fs.readFileString(path.join(outDir, "entrypoint.sh")))
         const composeBefore = yield* _(fs.readFileString(path.join(outDir, "docker-compose.yml")))
         expect(dockerfile).toContain("docker-compose-v2")
+        expect(dockerfile).toContain("gitleaks version")
         expect(entrypoint).toContain('DOCKER_GIT_HOME="/home/dev/.docker-git"')
         expect(entrypoint).toContain('SOURCE_SHARED_AUTH="/home/dev/.codex-shared/auth.json"')
         expect(entrypoint).toContain('OPENCODE_DATA_DIR="/home/dev/.local/share/opencode"')