@codemieai/code 0.8.0 → 0.10.0

package/scripts/validate-secrets.js

@@ -58,12 +58,28 @@ function detectEngine() {
 const engine = detectEngine();
 
 if (!engine) {
-  console.log('No container engine found - skipping secrets detection');
-  console.log('Install Docker, Podman, or Apple Containers to enable local secrets scanning');
-  process.exit(1);
+  if (process.env.CODEMIE_SKIP_SECRETS_SCAN !== '1') {
+    console.error('No container engine found — install Docker, Podman, or Apple Containers to enable local secrets scanning.');
+    console.error('To skip on this machine: set CODEMIE_SKIP_SECRETS_SCAN=1 in your shell environment.');
+    process.exit(1);
+  }
+  console.log('No container engine found — skipping secrets detection (CODEMIE_SKIP_SECRETS_SCAN=1)');
+  process.exit(0);
 }
 
 const engineBin = resolveCommand(engine);
+if (!engineBin) {
+  if (process.env.CODEMIE_SKIP_SECRETS_SCAN !== '1') {
+    console.error('Container engine binary not found — install Docker, Podman, or Apple Containers to enable local secrets scanning.');
+    console.error('To skip on this machine: set CODEMIE_SKIP_SECRETS_SCAN=1 in your shell environment.');
+    process.exit(1);
+  }
+  console.log('Container engine binary not found — skipping secrets detection (CODEMIE_SKIP_SECRETS_SCAN=1)');
+  process.exit(0);
+}
+// shell:true is used on Windows so paths with spaces must be quoted for the shell.
+// On Linux/Mac shell:false passes the path directly to execve — no quoting needed.
+const spawnBin = isWindows && engineBin.includes(' ') ? `"${engineBin}"` : engineBin;
 
 // Produce the staged diff on the host so gitleaks doesn't need git access
 // inside the container — required for Apple Containers which cannot run git
@@ -95,7 +111,7 @@ if (hasConfig) {
 
 console.log('Running Gitleaks secrets detection...');
 
-const gitleaks = spawn(engineBin, args, {
+const gitleaks = spawn(spawnBin, args, {
   stdio: ['pipe', 'inherit', 'inherit'],
   shell: isWindows,
 });