@b12k/gitleaks 0.0.0-v.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Bogdan Kolesnyk
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,108 @@
+# The missing npm wrapper for [Gitleaks](https://github.com/gitleaks/gitleaks)
+
+[Gitleaks](https://github.com/gitleaks/gitleaks) - is a fast, lightweight secret scanner for git repositories.
+
+This library is just a thin wrapper which automatically downloads the correct gitleaks binary for your platform on install and exposes it as a CLI command.
+
+## Installation
+
+Typically installed as a dev dependency:
+
+**Local (project)**
+
+```bash
+npm install --save-dev @b12k/gitleaks
+```
+
+```bash
+pnpm add -D --allow-build=@b12k/gitleaks @b12k/gitleaks
+```
+
+pnpm 11 requires the `--allow-build` flag so this package's postinstall script can download the gitleaks binary.
+
+```bash
+yarn add --dev @b12k/gitleaks
+```
+
+**Global**
+
+```bash
+npm install -g @b12k/gitleaks
+```
+
+```bash
+pnpm add -g --allow-build=@b12k/gitleaks @b12k/gitleaks
+```
+
+pnpm 11 requires the `--allow-build` flag during global install as well.
+
+```bash
+yarn global add @b12k/gitleaks
+```
+
+The postinstall script downloads the gitleaks binary for your platform from the official GitHub release.
+
+If you already installed with pnpm 11 and the build was blocked, approve and rebuild it:
+
+```bash
+pnpm approve-builds @b12k/gitleaks
+pnpm rebuild @b12k/gitleaks
+```
+
+## Usage
+
+See the [gitleaks documentation](https://github.com/gitleaks/gitleaks) for the full list of commands and flags.
+
+**Local install**
+
+```bash
+npx gitleaks <command>
+```
+
+```bash
+pnpm exec gitleaks <command>
+```
+
+```bash
+yarn gitleaks <command>
+```
+
+**Global install**
+
+```bash
+gitleaks <command>
+```
+
+**`package.json` script**
+
+```json
+{ "scripts": { "secrets": "gitleaks <command>" } }
+```
+
+## Troubleshooting
+
+If the binary fails to install, re-run with `--foreground-scripts` to see the postinstall output:
+
+```bash
+npm install --save-dev @b12k/gitleaks --foreground-scripts
+```
+
+```bash
+pnpm add -D --allow-build=@b12k/gitleaks @b12k/gitleaks --foreground-scripts
+```
+
+```bash
+yarn add --dev @b12k/gitleaks --foreground-scripts
+```
+
+## Supported platforms
+
+- Linux — x64, arm64
+- macOS — x64, arm64
+- Windows — x64, arm64
+
+## Version
+
+The npm package version mirrors the gitleaks release version.
+
+To install a different gitleaks release, define it in `.gitleaks-version` as `v1.2.3` or `1.2.3` before installing the package.

package/dist/cli.js

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+import { access } from "node:fs/promises";
+import update_notifier from "update-notifier";
+import { binaryPath, name as external_config_js_name, version } from "./config.js";
+import { logError } from "./log.js";
+function setErrorExitCode(errorName, metaInfo) {
+    try {
+        logError(errorName, metaInfo);
+    } catch  {
+        process.exitCode = 1;
+    }
+}
+update_notifier({
+    pkg: {
+        name: external_config_js_name,
+        version: version
+    },
+    shouldNotifyInNpmScript: true,
+    updateCheckInterval: 86400000
+}).notify({
+    defer: false
+});
+let canSpawn = true;
+try {
+    await access(binaryPath);
+} catch  {
+    setErrorExitCode('binaryNotFound');
+    canSpawn = false;
+}
+if (canSpawn) {
+    const childProcess = spawn(binaryPath, process.argv.slice(2), {
+        stdio: 'inherit'
+    });
+    childProcess.on('error', (error)=>{
+        setErrorExitCode('executionFailed', error.message);
+    });
+    childProcess.on('exit', (code, signal)=>{
+        if (signal) return void process.kill(process.pid, signal);
+        process.exitCode = code ?? 1;
+    });
+}

package/dist/config.js

@@ -0,0 +1,48 @@
+import { readFile } from "node:fs/promises";
+import node_path from "node:path";
+import package_0 from "../package.json" with {
+    type: "json"
+};
+const platform = 'win32' === process.platform ? 'windows' : process.platform;
+const isWindows = 'windows' === platform;
+const { arch: architecture } = process;
+const { name: config_name, version: version } = package_0;
+const [defaultVersion = ''] = version.split('-');
+const versionFileName = '.gitleaks-version';
+const versionFilePath = node_path.join(process.env['INIT_CWD'] ?? process.cwd(), versionFileName);
+let versionOverride;
+try {
+    const fileContents = await readFile(versionFilePath, 'utf8');
+    versionOverride = fileContents.trim().replace(/^v/, '');
+} catch (error) {
+    if ('ENOENT' !== error.code) {
+        const message = Error.isError(error) ? error.message : 'Unknown error.';
+        throw new Error(`Failed to read ${versionFileName}: ${message}`, {
+            cause: error
+        });
+    }
+    versionOverride = '';
+}
+const libraryVersion = versionOverride || defaultVersion;
+const currentDirectory = import.meta.dirname;
+const libraryName = 'gitleaks';
+const binaryExtension = isWindows ? '.exe' : '';
+const binaryFileName = `${libraryName}${binaryExtension}`;
+const binaryPath = node_path.join(currentDirectory, binaryFileName);
+const archiveExtension = isWindows ? '.zip' : '.tar.gz';
+const archiveFileName = `${libraryName}_${libraryVersion}_${platform}_${architecture}${archiveExtension}`;
+const checksumsFileName = `${libraryName}_${libraryVersion}_checksums.txt`;
+const gitLeaksGithubUrl = `https://github.com/gitleaks/gitleaks/releases/download/v${libraryVersion}`;
+const archiveGithubUrl = `${gitLeaksGithubUrl}/${archiveFileName}`;
+const checksumsGithubUrl = `${gitLeaksGithubUrl}/${checksumsFileName}`;
+const archivePath = node_path.join(currentDirectory, archiveFileName);
+const supportedPlatforms = [
+    'darwin',
+    'windows',
+    'linux'
+];
+const supportedArchitectures = [
+    'x64',
+    'arm64'
+];
+export { architecture, archiveFileName, archiveGithubUrl, archivePath, binaryPath, checksumsGithubUrl, config_name as name, currentDirectory, libraryName, libraryVersion, platform, supportedArchitectures, supportedPlatforms, version };

package/dist/errors.js

@@ -0,0 +1,27 @@
+const ERRORS_BY_KEY = {
+    binaryNotFound: {
+        instruction: 'Try re-installing the library.',
+        message: 'Binary not found.'
+    },
+    executionFailed: {
+        instruction: 'Try re-installing the library.',
+        message: 'Failed to execute the binary.'
+    },
+    installationFailed: {
+        instruction: '',
+        message: 'Failed to install the binary.'
+    },
+    unsupportedArchitecture: {
+        instruction: 'Supported architectures are x64 and arm64.',
+        message: 'Unsupported architecture.'
+    },
+    unsupportedArchiveFormat: {
+        instruction: 'Supported archive formats are .zip and .tar.gz.',
+        message: 'Unsupported archive format.'
+    },
+    unsupportedPlatform: {
+        instruction: 'Supported platforms are darwin, windows and linux.',
+        message: 'Unsupported platform.'
+    }
+};
+export { ERRORS_BY_KEY };

package/dist/extract-archive.js

@@ -0,0 +1,14 @@
+import extract_zip from "extract-zip";
+import { extract } from "tar";
+import { logError } from "./log.js";
+async function extractArchive(archivePath, targetDirectoryPath) {
+    if (archivePath.endsWith('.zip')) return void await extract_zip(archivePath, {
+        dir: targetDirectoryPath
+    });
+    if (archivePath.endsWith('.tar.gz')) return void await extract({
+        cwd: targetDirectoryPath,
+        file: archivePath
+    });
+    logError('unsupportedArchiveFormat', archivePath);
+}
+export { extractArchive };

package/dist/log.js

@@ -0,0 +1,19 @@
+import boxen from "boxen";
+import { libraryName } from "./config.js";
+import { ERRORS_BY_KEY } from "./errors.js";
+function log(message, options) {
+    console.log(boxen(message, options));
+}
+const errorPrefix = `[${libraryName}]`;
+function logError(errorName, metaInfo) {
+    const error = ERRORS_BY_KEY[errorName];
+    let logMessage = error.message;
+    if (error.instruction) logMessage += `\n\n${error.instruction}`;
+    if (metaInfo) logMessage += `\n\n${metaInfo}`;
+    log(logMessage, {
+        borderColor: 'red',
+        title: errorPrefix
+    });
+    throw new Error(`${errorPrefix} ${error.message}`);
+}
+export { log, logError };

package/dist/postinstall.js

@@ -0,0 +1,73 @@
+import { createHash } from "node:crypto";
+import { createWriteStream } from "node:fs";
+import { readFile, rm } from "node:fs/promises";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { architecture, archiveFileName, archiveGithubUrl, archivePath, binaryPath, checksumsGithubUrl, currentDirectory, libraryName, platform, supportedArchitectures, supportedPlatforms } from "./config.js";
+import { extractArchive } from "./extract-archive.js";
+import { log, logError } from "./log.js";
+const DOWNLOAD_TIMEOUT_MS = 300000;
+if (!supportedPlatforms.includes(platform)) logError('unsupportedPlatform');
+if (!supportedArchitectures.includes(architecture)) logError('unsupportedArchitecture');
+async function createFetchResponse(url) {
+    const response = await fetch(url, {
+        signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS)
+    });
+    if (!response.ok) throw new Error(String(response.status));
+    return response;
+}
+async function downloadArchive() {
+    log(archiveGithubUrl, {
+        borderColor: 'green',
+        title: `${libraryName}:download`
+    });
+    const response = await createFetchResponse(archiveGithubUrl);
+    if (!response.body) throw new Error('Archive download returned no body.');
+    log(archivePath, {
+        borderColor: 'green',
+        title: `${libraryName}:save`
+    });
+    await pipeline(Readable.fromWeb(response.body), createWriteStream(archivePath));
+}
+async function ensureArchiveChecksum() {
+    log(checksumsGithubUrl, {
+        borderColor: 'green',
+        title: `${libraryName}:verify`
+    });
+    const response = await createFetchResponse(checksumsGithubUrl);
+    const checksums = await response.text();
+    const checksum = checksums.split('\n').find((line)=>line.endsWith(` ${archiveFileName}`))?.split(/\s+/, 1)[0];
+    if (!checksum) throw new Error(`Checksum not found for ${archiveFileName}.`);
+    const archive = await readFile(archivePath);
+    const actualChecksum = createHash('sha256').update(archive).digest('hex');
+    if (actualChecksum !== checksum) throw new Error(`Checksum mismatch for ${archiveFileName}.`);
+}
+async function install() {
+    await downloadArchive();
+    await ensureArchiveChecksum();
+    log(currentDirectory, {
+        borderColor: 'green',
+        title: `${libraryName}:extract`
+    });
+    await extractArchive(archivePath, currentDirectory);
+    log(binaryPath, {
+        borderColor: 'green',
+        title: `${libraryName}:installed`
+    });
+}
+async function installWithCleanup() {
+    try {
+        await install();
+    } finally{
+        await rm(archivePath, {
+            force: true
+        });
+    }
+}
+try {
+    await installWithCleanup();
+} catch (error) {
+    let message = 'Unknown error.';
+    if (Error.isError(error)) message = error.message;
+    logError('installationFailed', message);
+}

package/package.json

@@ -0,0 +1,102 @@
+{
+  "name": "@b12k/gitleaks",
+  "version": "0.0.0-v.1",
+  "description": "The missing NPM wrapper for Gitleaks",
+  "keywords": [
+    "api-keys",
+    "cli",
+    "data-loss-prevention",
+    "devsecops",
+    "dlp",
+    "files",
+    "git",
+    "gitleaks",
+    "npm",
+    "passwords",
+    "secret",
+    "secrets",
+    "security",
+    "security-tools",
+    "stdin",
+    "tokens",
+    "wrapper"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/b12k/gitleaks.git"
+  },
+  "license": "MIT",
+  "author": "Bogdan Kolesnyk",
+  "type": "module",
+  "bin": {
+    "gitleaks": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "scripts"
+  ],
+  "scripts": {
+    "build": "rslib",
+    "check": "run-p -l check:*",
+    "check:format": "prettier . --check",
+    "check:package-json": "sort-package-json --check",
+    "check:scripts": "eslint . --cache",
+    "check:types": "tsc --noEmit",
+    "deps:check": "ncu -e 1 -c 7",
+    "deps:update": "ncu -du --doctorTest \"pnpm deps:update:doctor\" -c 7",
+    "deps:update:doctor": "run-p -l check:types check:scripts build",
+    "dev": "rslib --watch",
+    "fix": "run-p -l fix:*",
+    "fix:format": "prettier . --write",
+    "fix:package-json": "sort-package-json",
+    "fix:scripts": "eslint . --fix --cache",
+    "ga:notify": "tsx .github/notify.ts",
+    "ga:update-gitleaks": "tsx .github/update-gitleaks.ts",
+    "husky:commit-msg": "commitlint",
+    "husky:pre-commit": "lint-staged",
+    "husky:pre-push": "branch-name-lint",
+    "postinstall": "node scripts/postinstall.js",
+    "prepack": "run-p check build",
+    "prepare": "husky",
+    "release": "release-it --preRelease=v"
+  },
+  "dependencies": {
+    "boxen": "8.0.1",
+    "extract-zip": "2.0.1",
+    "tar": "7.5.19",
+    "update-notifier": "7.3.1"
+  },
+  "devDependencies": {
+    "@b12k/branch-name-lint": "1.3.0",
+    "@commitlint/config-conventional": "21.1.0",
+    "@eslint/js": "10.0.1",
+    "@release-it/conventional-changelog": "11.0.1",
+    "@rslib/core": "0.23.1",
+    "@types/node": "26.0.1",
+    "@types/semver": "7.7.1",
+    "@types/update-notifier": "6.0.8",
+    "commitlint": "21.1.0",
+    "eslint": "10.6.0",
+    "eslint-config-airbnb-extended": "3.1.0",
+    "eslint-config-prettier": "10.1.8",
+    "eslint-plugin-perfectionist": "5.9.1",
+    "eslint-plugin-unicorn": "70.0.0",
+    "husky": "9.1.7",
+    "lint-staged": "17.0.8",
+    "npm-check-updates": "22.2.9",
+    "npm-run-all2": "9.0.2",
+    "prettier": "3.9.1",
+    "release-it": "20.2.1",
+    "semver": "7.8.5",
+    "sort-package-json": "4.0.0",
+    "tsx": "4.22.4",
+    "typescript": "6.0.3"
+  },
+  "packageManager": "pnpm@11.10.0",
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/scripts/postinstall.js

@@ -0,0 +1,6 @@
+import path from 'node:path';
+
+const directory = import.meta.dirname;
+// eslint-disable-next-line n/no-process-exit
+if (!directory.includes('node_modules')) process.exit(0);
+await import(path.join(directory, '../dist/postinstall.js'));