@taimos/projen 0.1.85 → 0.1.86

package/API.md

@@ -567,6 +567,265 @@ The generated production release workflow.
 ---
 
 
+### Gitleaks <a name="Gitleaks" id="@taimos/projen.Gitleaks"></a>
+
+gitleaks secret-scanning for a project: a `.gitleaks.toml` config that extends the bundled default ruleset plus tightly path-scoped allowlists, and a pull-request workflow that scans the full git history against it.
+
+projen has no native gitleaks component, so both artifacts are generated here
+to stay in the "never hand-edit generated files" model. Requires GitHub to be
+enabled on the project.
+
+#### Initializers <a name="Initializers" id="@taimos/projen.Gitleaks.Initializer"></a>
+
+```typescript
+import { Gitleaks } from '@taimos/projen'
+
+new Gitleaks(scope: TypeScriptProject, options?: GitleaksOptions)
+```
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@taimos/projen.Gitleaks.Initializer.parameter.scope">scope</a></code> | <code>projen.typescript.TypeScriptProject</code> | *No description.* |
+| <code><a href="#@taimos/projen.Gitleaks.Initializer.parameter.options">options</a></code> | <code><a href="#@taimos/projen.GitleaksOptions">GitleaksOptions</a></code> | *No description.* |
+
+---
+
+##### `scope`<sup>Required</sup> <a name="scope" id="@taimos/projen.Gitleaks.Initializer.parameter.scope"></a>
+
+- *Type:* projen.typescript.TypeScriptProject
+
+---
+
+##### `options`<sup>Optional</sup> <a name="options" id="@taimos/projen.Gitleaks.Initializer.parameter.options"></a>
+
+- *Type:* <a href="#@taimos/projen.GitleaksOptions">GitleaksOptions</a>
+
+---
+
+#### Methods <a name="Methods" id="Methods"></a>
+
+| **Name** | **Description** |
+| --- | --- |
+| <code><a href="#@taimos/projen.Gitleaks.toString">toString</a></code> | Returns a string representation of this construct. |
+| <code><a href="#@taimos/projen.Gitleaks.with">with</a></code> | Applies one or more mixins to this construct. |
+| <code><a href="#@taimos/projen.Gitleaks.postProjectCreation">postProjectCreation</a></code> | Called once, right after `postSynthesize()`, only when the project is created for the first time. |
+| <code><a href="#@taimos/projen.Gitleaks.postSynthesize">postSynthesize</a></code> | Called after synthesis. |
+| <code><a href="#@taimos/projen.Gitleaks.preSynthesize">preSynthesize</a></code> | Called before synthesis. |
+| <code><a href="#@taimos/projen.Gitleaks.projectCreation">projectCreation</a></code> | Called once, right after `synthesize()`, only when the project is created for the first time. |
+| <code><a href="#@taimos/projen.Gitleaks.synthesize">synthesize</a></code> | Synthesizes files to the project output directory. |
+
+---
+
+##### `toString` <a name="toString" id="@taimos/projen.Gitleaks.toString"></a>
+
+```typescript
+public toString(): string
+```
+
+Returns a string representation of this construct.
+
+##### `with` <a name="with" id="@taimos/projen.Gitleaks.with"></a>
+
+```typescript
+public with(mixins: ...IMixin[]): IConstruct
+```
+
+Applies one or more mixins to this construct.
+
+Mixins are applied in order. The list of constructs is captured at the
+start of the call, so constructs added by a mixin will not be visited.
+Use multiple `with()` calls if subsequent mixins should apply to added
+constructs.
+
+###### `mixins`<sup>Required</sup> <a name="mixins" id="@taimos/projen.Gitleaks.with.parameter.mixins"></a>
+
+- *Type:* ...constructs.IMixin[]
+
+The mixins to apply.
+
+---
+
+##### `postProjectCreation` <a name="postProjectCreation" id="@taimos/projen.Gitleaks.postProjectCreation"></a>
+
+```typescript
+public postProjectCreation(initProject: InitProject): void
+```
+
+Called once, right after `postSynthesize()`, only when the project is created for the first time.
+
+It does not run on later `projen` invocations. It only fires for `projen new` (or `Projects.createProject`).
+It is also skipped when post-synthesis steps are disabled, e.g. `--no-post` or `PROJEN_DISABLE_POST`.
+Use it for one-off setup that can be turned off by the user, like running a task to give the user immediate
+feedback on their new project. Order across components is not guaranteed.
+
+###### `initProject`<sup>Required</sup> <a name="initProject" id="@taimos/projen.Gitleaks.postProjectCreation.parameter.initProject"></a>
+
+- *Type:* projen.InitProject
+
+Details about how the project was created, e.g. its type and the original CLI args.
+
+---
+
+##### `postSynthesize` <a name="postSynthesize" id="@taimos/projen.Gitleaks.postSynthesize"></a>
+
+```typescript
+public postSynthesize(): void
+```
+
+Called after synthesis.
+
+Order is *not* guaranteed.
+
+##### `preSynthesize` <a name="preSynthesize" id="@taimos/projen.Gitleaks.preSynthesize"></a>
+
+```typescript
+public preSynthesize(): void
+```
+
+Called before synthesis.
+
+##### `projectCreation` <a name="projectCreation" id="@taimos/projen.Gitleaks.projectCreation"></a>
+
+```typescript
+public projectCreation(initProject: InitProject): void
+```
+
+Called once, right after `synthesize()`, only when the project is created for the first time.
+
+It does not run on later `projen` invocations. It only fires for `projen new` (or `Projects.createProject`).
+Use it for deterministic, one-off file generation. Order across components is not guaranteed.
+
+###### `initProject`<sup>Required</sup> <a name="initProject" id="@taimos/projen.Gitleaks.projectCreation.parameter.initProject"></a>
+
+- *Type:* projen.InitProject
+
+Details about how the project was created, e.g. its type and the original CLI args.
+
+---
+
+##### `synthesize` <a name="synthesize" id="@taimos/projen.Gitleaks.synthesize"></a>
+
+```typescript
+public synthesize(): void
+```
+
+Synthesizes files to the project output directory.
+
+#### Static Functions <a name="Static Functions" id="Static Functions"></a>
+
+| **Name** | **Description** |
+| --- | --- |
+| <code><a href="#@taimos/projen.Gitleaks.isConstruct">isConstruct</a></code> | Checks if `x` is a construct. |
+| <code><a href="#@taimos/projen.Gitleaks.isComponent">isComponent</a></code> | Test whether the given construct is a component. |
+
+---
+
+##### `isConstruct` <a name="isConstruct" id="@taimos/projen.Gitleaks.isConstruct"></a>
+
+```typescript
+import { Gitleaks } from '@taimos/projen'
+
+Gitleaks.isConstruct(x: any)
+```
+
+Checks if `x` is a construct.
+
+Use this method instead of `instanceof` to properly detect `Construct`
+instances, even when the construct library is symlinked.
+
+Explanation: in JavaScript, multiple copies of the `constructs` library on
+disk are seen as independent, completely different libraries. As a
+consequence, the class `Construct` in each copy of the `constructs` library
+is seen as a different class, and an instance of one class will not test as
+`instanceof` the other class. `npm install` will not create installations
+like this, but users may manually symlink construct libraries together or
+use a monorepo tool: in those cases, multiple copies of the `constructs`
+library can be accidentally installed, and `instanceof` will behave
+unpredictably. It is safest to avoid using `instanceof`, and using
+this type-testing method instead.
+
+###### `x`<sup>Required</sup> <a name="x" id="@taimos/projen.Gitleaks.isConstruct.parameter.x"></a>
+
+- *Type:* any
+
+Any object.
+
+---
+
+##### `isComponent` <a name="isComponent" id="@taimos/projen.Gitleaks.isComponent"></a>
+
+```typescript
+import { Gitleaks } from '@taimos/projen'
+
+Gitleaks.isComponent(x: any)
+```
+
+Test whether the given construct is a component.
+
+###### `x`<sup>Required</sup> <a name="x" id="@taimos/projen.Gitleaks.isComponent.parameter.x"></a>
+
+- *Type:* any
+
+---
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@taimos/projen.Gitleaks.property.node">node</a></code> | <code>constructs.Node</code> | The tree node. |
+| <code><a href="#@taimos/projen.Gitleaks.property.project">project</a></code> | <code>projen.Project</code> | *No description.* |
+| <code><a href="#@taimos/projen.Gitleaks.property.configFile">configFile</a></code> | <code>projen.TextFile</code> | The generated `.gitleaks.toml`. |
+| <code><a href="#@taimos/projen.Gitleaks.property.workflow">workflow</a></code> | <code>projen.github.GithubWorkflow</code> | The generated pull-request scanning workflow. |
+
+---
+
+##### `node`<sup>Required</sup> <a name="node" id="@taimos/projen.Gitleaks.property.node"></a>
+
+```typescript
+public readonly node: Node;
+```
+
+- *Type:* constructs.Node
+
+The tree node.
+
+---
+
+##### `project`<sup>Required</sup> <a name="project" id="@taimos/projen.Gitleaks.property.project"></a>
+
+```typescript
+public readonly project: Project;
+```
+
+- *Type:* projen.Project
+
+---
+
+##### `configFile`<sup>Required</sup> <a name="configFile" id="@taimos/projen.Gitleaks.property.configFile"></a>
+
+```typescript
+public readonly configFile: TextFile;
+```
+
+- *Type:* projen.TextFile
+
+The generated `.gitleaks.toml`.
+
+---
+
+##### `workflow`<sup>Required</sup> <a name="workflow" id="@taimos/projen.Gitleaks.property.workflow"></a>
+
+```typescript
+public readonly workflow: GithubWorkflow;
+```
+
+- *Type:* projen.github.GithubWorkflow
+
+The generated pull-request scanning workflow.
+
+---
+
+
 ### MonorepoProject <a name="MonorepoProject" id="@taimos/projen.MonorepoProject"></a>
 
 Private PNPM-workspace monorepo root, following Taimos ADR-0002.
@@ -1240,6 +1499,7 @@ When given a project, this it the project itself.
 | <code><a href="#@taimos/projen.MonorepoProject.property.amplifyDeploy">amplifyDeploy</a></code> | <code><a href="#@taimos/projen.GitHubAmplifyDeploy">GitHubAmplifyDeploy</a></code> | The Amplify deploy workflows, when `amplifyDeployOptions` is set. |
 | <code><a href="#@taimos/projen.MonorepoProject.property.amplifyFile">amplifyFile</a></code> | <code>projen.YamlFile</code> | The generated `amplify.yml`, if any Amplify apps were configured. |
 | <code><a href="#@taimos/projen.MonorepoProject.property.assignApprover">assignApprover</a></code> | <code>projen-pipelines.GitHubAssignApprover</code> | The PR approver assignment, if enabled. |
+| <code><a href="#@taimos/projen.MonorepoProject.property.gitleaks">gitleaks</a></code> | <code><a href="#@taimos/projen.Gitleaks">Gitleaks</a></code> | The gitleaks secret-scanning component, if enabled. |
 | <code><a href="#@taimos/projen.MonorepoProject.property.productionRelease">productionRelease</a></code> | <code><a href="#@taimos/projen.GitHubProductionRelease">GitHubProductionRelease</a></code> | The production release workflow, if enabled. |
 
 ---
@@ -2013,6 +2273,18 @@ The PR approver assignment, if enabled.
 
 ---
 
+##### `gitleaks`<sup>Optional</sup> <a name="gitleaks" id="@taimos/projen.MonorepoProject.property.gitleaks"></a>
+
+```typescript
+public readonly gitleaks: Gitleaks;
+```
+
+- *Type:* <a href="#@taimos/projen.Gitleaks">Gitleaks</a>
+
+The gitleaks secret-scanning component, if enabled.
+
+---
+
 ##### `productionRelease`<sup>Optional</sup> <a name="productionRelease" id="@taimos/projen.MonorepoProject.property.productionRelease"></a>
 
 ```typescript
@@ -11042,6 +11314,145 @@ The name of the generated workflow (and its `.yml` file).
 
 ---
 
+### GitleaksAllowlist <a name="GitleaksAllowlist" id="@taimos/projen.GitleaksAllowlist"></a>
+
+One path-scoped allowlist entry for the generated `.gitleaks.toml`.
+
+Each entry is rendered as a `[[allowlists]]` block. Keep every allowlist as
+tightly path-scoped as possible so it cannot mask a real secret elsewhere in
+the repo.
+
+#### Initializer <a name="Initializer" id="@taimos/projen.GitleaksAllowlist.Initializer"></a>
+
+```typescript
+import { GitleaksAllowlist } from '@taimos/projen'
+
+const gitleaksAllowlist: GitleaksAllowlist = { ... }
+```
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@taimos/projen.GitleaksAllowlist.property.description">description</a></code> | <code>string</code> | Human-readable description of what this allowlist exempts and why. |
+| <code><a href="#@taimos/projen.GitleaksAllowlist.property.condition">condition</a></code> | <code>string</code> | gitleaks `condition` combining `paths` and `regexes` (`AND` requires both). |
+| <code><a href="#@taimos/projen.GitleaksAllowlist.property.paths">paths</a></code> | <code>string[]</code> | Regex paths the allowlist applies to (rendered as gitleaks `paths`), e.g. `['^\\.npmrc$']`. Omit to apply the regexes repo-wide (discouraged). |
+| <code><a href="#@taimos/projen.GitleaksAllowlist.property.regexes">regexes</a></code> | <code>string[]</code> | Regexes matching the allowed secret values (rendered as gitleaks `regexes`). |
+| <code><a href="#@taimos/projen.GitleaksAllowlist.property.regexTarget">regexTarget</a></code> | <code>string</code> | gitleaks `regexTarget` (`secret` \| `match` \| `line`). |
+
+---
+
+##### `description`<sup>Required</sup> <a name="description" id="@taimos/projen.GitleaksAllowlist.property.description"></a>
+
+```typescript
+public readonly description: string;
+```
+
+- *Type:* string
+
+Human-readable description of what this allowlist exempts and why.
+
+---
+
+##### `condition`<sup>Optional</sup> <a name="condition" id="@taimos/projen.GitleaksAllowlist.property.condition"></a>
+
+```typescript
+public readonly condition: string;
+```
+
+- *Type:* string
+- *Default:* gitleaks default (OR)
+
+gitleaks `condition` combining `paths` and `regexes` (`AND` requires both).
+
+---
+
+##### `paths`<sup>Optional</sup> <a name="paths" id="@taimos/projen.GitleaksAllowlist.property.paths"></a>
+
+```typescript
+public readonly paths: string[];
+```
+
+- *Type:* string[]
+- *Default:* no path scope
+
+Regex paths the allowlist applies to (rendered as gitleaks `paths`), e.g. `['^\\.npmrc$']`. Omit to apply the regexes repo-wide (discouraged).
+
+---
+
+##### `regexes`<sup>Optional</sup> <a name="regexes" id="@taimos/projen.GitleaksAllowlist.property.regexes"></a>
+
+```typescript
+public readonly regexes: string[];
+```
+
+- *Type:* string[]
+- *Default:* no value regexes
+
+Regexes matching the allowed secret values (rendered as gitleaks `regexes`).
+
+Omit to allow anything on the scoped paths.
+
+---
+
+##### `regexTarget`<sup>Optional</sup> <a name="regexTarget" id="@taimos/projen.GitleaksAllowlist.property.regexTarget"></a>
+
+```typescript
+public readonly regexTarget: string;
+```
+
+- *Type:* string
+- *Default:* gitleaks default
+
+gitleaks `regexTarget` (`secret` | `match` | `line`).
+
+---
+
+### GitleaksOptions <a name="GitleaksOptions" id="@taimos/projen.GitleaksOptions"></a>
+
+#### Initializer <a name="Initializer" id="@taimos/projen.GitleaksOptions.Initializer"></a>
+
+```typescript
+import { GitleaksOptions } from '@taimos/projen'
+
+const gitleaksOptions: GitleaksOptions = { ... }
+```
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@taimos/projen.GitleaksOptions.property.allowlists">allowlists</a></code> | <code><a href="#@taimos/projen.GitleaksAllowlist">GitleaksAllowlist</a>[]</code> | Path-scoped allowlists for known false positives, appended after `[extend] useDefault = true`. |
+| <code><a href="#@taimos/projen.GitleaksOptions.property.version">version</a></code> | <code>string</code> | The gitleaks version downloaded in CI. |
+
+---
+
+##### `allowlists`<sup>Optional</sup> <a name="allowlists" id="@taimos/projen.GitleaksOptions.property.allowlists"></a>
+
+```typescript
+public readonly allowlists: GitleaksAllowlist[];
+```
+
+- *Type:* <a href="#@taimos/projen.GitleaksAllowlist">GitleaksAllowlist</a>[]
+- *Default:* []
+
+Path-scoped allowlists for known false positives, appended after `[extend] useDefault = true`.
+
+---
+
+##### `version`<sup>Optional</sup> <a name="version" id="@taimos/projen.GitleaksOptions.property.version"></a>
+
+```typescript
+public readonly version: string;
+```
+
+- *Type:* string
+- *Default:* '8.30.1'
+
+The gitleaks version downloaded in CI.
+
+---
+
 ### MonorepoAmplifyApp <a name="MonorepoAmplifyApp" id="@taimos/projen.MonorepoAmplifyApp"></a>
 
 One AWS Amplify Hosting application served from a workspace package.
@@ -11415,6 +11826,8 @@ const monorepoProjectOptions: MonorepoProjectOptions = { ... }
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.assignApprover">assignApprover</a></code> | <code>boolean</code> | Whether to assign PR approvers via `GitHubAssignApprover`. |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.cdkServerless">cdkServerless</a></code> | <code>boolean</code> | Whether to add `cdk-serverless` as a workspace dev dependency. |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.defaultApprovers">defaultApprovers</a></code> | <code>string[]</code> | Approvers assigned when no author-specific mapping matches. |
+| <code><a href="#@taimos/projen.MonorepoProjectOptions.property.gitleaks">gitleaks</a></code> | <code>boolean</code> | Whether to add gitleaks secret-scanning: a `.gitleaks.toml` config plus a pull-request workflow that scans the full git history (see `Gitleaks`). |
+| <code><a href="#@taimos/projen.MonorepoProjectOptions.property.gitleaksOptions">gitleaksOptions</a></code> | <code><a href="#@taimos/projen.GitleaksOptions">GitleaksOptions</a></code> | Options for the gitleaks component. |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.nodeVersion">nodeVersion</a></code> | <code>string</code> | The Node.js version used in the generated build workflow. |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.pnpmWorkspaceVersion">pnpmWorkspaceVersion</a></code> | <code>string</code> | The pnpm version pinned for the workspace and CI. |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.productionRelease">productionRelease</a></code> | <code>boolean</code> | Whether to add a manual "Production Release" workflow that promotes a branch to the production branch (see `GitHubProductionRelease`). |
@@ -13697,6 +14110,34 @@ Only used when `assignApprover` is enabled.
 
 ---
 
+##### `gitleaks`<sup>Optional</sup> <a name="gitleaks" id="@taimos/projen.MonorepoProjectOptions.property.gitleaks"></a>
+
+```typescript
+public readonly gitleaks: boolean;
+```
+
+- *Type:* boolean
+- *Default:* false
+
+Whether to add gitleaks secret-scanning: a `.gitleaks.toml` config plus a pull-request workflow that scans the full git history (see `Gitleaks`).
+
+---
+
+##### `gitleaksOptions`<sup>Optional</sup> <a name="gitleaksOptions" id="@taimos/projen.MonorepoProjectOptions.property.gitleaksOptions"></a>
+
+```typescript
+public readonly gitleaksOptions: GitleaksOptions;
+```
+
+- *Type:* <a href="#@taimos/projen.GitleaksOptions">GitleaksOptions</a>
+- *Default:* extend the default ruleset, no extra allowlists
+
+Options for the gitleaks component.
+
+Only used when `gitleaks` is enabled.
+
+---
+
 ##### `nodeVersion`<sup>Optional</sup> <a name="nodeVersion" id="@taimos/projen.MonorepoProjectOptions.property.nodeVersion"></a>
 
 ```typescript

package/lib/components/amplify-deploy.js

@@ -43,7 +43,7 @@ const DEFAULT_SHARED_BUILD_PATHS = [
  * assume-role or parameter-read step rather than skipping a deploy.
  */
 class GitHubAmplifyDeploy extends projen_1.Component {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@taimos/projen.GitHubAmplifyDeploy", version: "0.1.85" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@taimos/projen.GitHubAmplifyDeploy", version: "0.1.86" };
     /** The generated deploy workflows, one per app. */
     workflows = [];
     /** Name of the IAM role CI chains into, in every stage account. */

package/lib/components/gitleaks.d.ts

@@ -0,0 +1,69 @@
+import { Component, TextFile, github, typescript } from 'projen';
+/**
+ * One path-scoped allowlist entry for the generated `.gitleaks.toml`.
+ *
+ * Each entry is rendered as a `[[allowlists]]` block. Keep every allowlist as
+ * tightly path-scoped as possible so it cannot mask a real secret elsewhere in
+ * the repo.
+ */
+export interface GitleaksAllowlist {
+    /** Human-readable description of what this allowlist exempts and why. */
+    readonly description: string;
+    /**
+     * Regex paths the allowlist applies to (rendered as gitleaks `paths`), e.g.
+     * `['^\\.npmrc$']`. Omit to apply the regexes repo-wide (discouraged).
+     *
+     * @default - no path scope
+     */
+    readonly paths?: string[];
+    /**
+     * Regexes matching the allowed secret values (rendered as gitleaks
+     * `regexes`). Omit to allow anything on the scoped paths.
+     *
+     * @default - no value regexes
+     */
+    readonly regexes?: string[];
+    /**
+     * gitleaks `condition` combining `paths` and `regexes` (`AND` requires both).
+     *
+     * @default - gitleaks default (OR)
+     */
+    readonly condition?: string;
+    /**
+     * gitleaks `regexTarget` (`secret` | `match` | `line`).
+     *
+     * @default - gitleaks default
+     */
+    readonly regexTarget?: string;
+}
+export interface GitleaksOptions {
+    /**
+     * The gitleaks version downloaded in CI.
+     *
+     * @default '8.30.1'
+     */
+    readonly version?: string;
+    /**
+     * Path-scoped allowlists for known false positives, appended after
+     * `[extend] useDefault = true`.
+     *
+     * @default []
+     */
+    readonly allowlists?: GitleaksAllowlist[];
+}
+/**
+ * gitleaks secret-scanning for a project: a `.gitleaks.toml` config that extends
+ * the bundled default ruleset plus tightly path-scoped allowlists, and a
+ * pull-request workflow that scans the full git history against it.
+ *
+ * projen has no native gitleaks component, so both artifacts are generated here
+ * to stay in the "never hand-edit generated files" model. Requires GitHub to be
+ * enabled on the project.
+ */
+export declare class Gitleaks extends Component {
+    /** The generated `.gitleaks.toml`. */
+    readonly configFile: TextFile;
+    /** The generated pull-request scanning workflow. */
+    readonly workflow: github.GithubWorkflow;
+    constructor(scope: typescript.TypeScriptProject, options?: GitleaksOptions);
+}

package/lib/components/gitleaks.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Gitleaks = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const projen_1 = require("projen");
+/**
+ * gitleaks secret-scanning for a project: a `.gitleaks.toml` config that extends
+ * the bundled default ruleset plus tightly path-scoped allowlists, and a
+ * pull-request workflow that scans the full git history against it.
+ *
+ * projen has no native gitleaks component, so both artifacts are generated here
+ * to stay in the "never hand-edit generated files" model. Requires GitHub to be
+ * enabled on the project.
+ */
+class Gitleaks extends projen_1.Component {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@taimos/projen.Gitleaks", version: "0.1.86" };
+    /** The generated `.gitleaks.toml`. */
+    configFile;
+    /** The generated pull-request scanning workflow. */
+    workflow;
+    constructor(scope, options = {}) {
+        super(scope);
+        if (!scope.github) {
+            throw new Error('Gitleaks requires GitHub to be enabled on the project');
+        }
+        const version = options.version ?? '8.30.1';
+        const allowlists = options.allowlists ?? [];
+        const lines = [
+            '# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".',
+            '#',
+            '# gitleaks config. Extends the default ruleset, then adds tightly scoped',
+            '# allowlists for known false positives. Each allowlist is path-scoped so it',
+            '# cannot mask a real secret elsewhere in the repo.',
+            '[extend]',
+            'useDefault = true',
+        ];
+        for (const a of allowlists) {
+            lines.push('', `# ${a.description}`, '[[allowlists]]', `description = ${JSON.stringify(a.description)}`);
+            if (a.condition) {
+                lines.push(`condition = ${JSON.stringify(a.condition)}`);
+            }
+            if (a.regexTarget) {
+                lines.push(`regexTarget = ${JSON.stringify(a.regexTarget)}`);
+            }
+            if (a.paths && a.paths.length > 0) {
+                lines.push(`paths = [${a.paths.map((p) => `'''${p}'''`).join(', ')}]`);
+            }
+            if (a.regexes && a.regexes.length > 0) {
+                lines.push(`regexes = [${a.regexes.map((r) => `'''${r}'''`).join(', ')}]`);
+            }
+        }
+        this.configFile = new projen_1.TextFile(scope, '.gitleaks.toml', {
+            lines,
+            // A `//`-style projen marker is invalid TOML; the `#` marker is baked in.
+            marker: false,
+        });
+        this.workflow = scope.github.addWorkflow('gitleaks');
+        // Secrets can land in any path, so no path filter — plus merge queue and
+        // manual dispatch, matching the repo's other workflows.
+        this.workflow.on({
+            pullRequest: {},
+            mergeGroup: {},
+            workflowDispatch: {},
+        });
+        this.workflow.addJob('gitleaks', {
+            runsOn: ['ubuntu-latest'],
+            permissions: { contents: projen_1.github.workflows.JobPermission.READ },
+            steps: [
+                {
+                    name: 'Checkout',
+                    uses: 'actions/checkout@v4',
+                    // Full history so gitleaks scans every commit in the PR, not just HEAD.
+                    with: { 'fetch-depth': 0 },
+                },
+                {
+                    name: 'Install gitleaks',
+                    run: [
+                        `curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v${version}/gitleaks_${version}_linux_x64.tar.gz \\`,
+                        '  | tar -xz gitleaks',
+                        'sudo mv gitleaks /usr/local/bin/gitleaks',
+                    ].join('\n'),
+                },
+                {
+                    name: 'Scan git history',
+                    // --redact keeps any real secret out of the public CI logs.
+                    run: 'gitleaks git --no-banner --redact .',
+                },
+            ],
+        });
+    }
+}
+exports.Gitleaks = Gitleaks;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2l0bGVha3MuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY29tcG9uZW50cy9naXRsZWFrcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7O0FBQUEsbUNBQWlFO0FBd0RqRTs7Ozs7Ozs7R0FRRztBQUNILE1BQWEsUUFBUyxTQUFRLGtCQUFTOztJQUVyQyxzQ0FBc0M7SUFDdEIsVUFBVSxDQUFXO0lBRXJDLG9EQUFvRDtJQUNwQyxRQUFRLENBQXdCO0lBRWhELFlBQVksS0FBbUMsRUFBRSxVQUEyQixFQUFFO1FBQzVFLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUViLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDbEIsTUFBTSxJQUFJLEtBQUssQ0FBQyx1REFBdUQsQ0FBQyxDQUFDO1FBQzNFLENBQUM7UUFFRCxNQUFNLE9BQU8sR0FBRyxPQUFPLENBQUMsT0FBTyxJQUFJLFFBQVEsQ0FBQztRQUM1QyxNQUFNLFVBQVUsR0FBRyxPQUFPLENBQUMsVUFBVSxJQUFJLEVBQUUsQ0FBQztRQUU1QyxNQUFNLEtBQUssR0FBYTtZQUN0Qiw4RUFBOEU7WUFDOUUsR0FBRztZQUNILDBFQUEwRTtZQUMxRSw2RUFBNkU7WUFDN0Usb0RBQW9EO1lBQ3BELFVBQVU7WUFDVixtQkFBbUI7U0FDcEIsQ0FBQztRQUNGLEtBQUssTUFBTSxDQUFDLElBQUksVUFBVSxFQUFFLENBQUM7WUFDM0IsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsS0FBSyxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsZ0JBQWdCLEVBQUUsaUJBQWlCLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUN6RyxJQUFJLENBQUMsQ0FBQyxTQUFTLEVBQUUsQ0FBQztnQkFDaEIsS0FBSyxDQUFDLElBQUksQ0FBQyxlQUFlLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUMzRCxDQUFDO1lBQ0QsSUFBSSxDQUFDLENBQUMsV0FBVyxFQUFFLENBQUM7Z0JBQ2xCLEtBQUssQ0FBQyxJQUFJLENBQUMsaUJBQWlCLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUMvRCxDQUFDO1lBQ0QsSUFBSSxDQUFDLENBQUMsS0FBSyxJQUFJLENBQUMsQ0FBQyxLQUFLLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO2dCQUNsQyxLQUFLLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQ3pFLENBQUM7WUFDRCxJQUFJLENBQUMsQ0FBQyxPQUFPLElBQUksQ0FBQyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQ3RDLEtBQUssQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDN0UsQ0FBQztRQUNILENBQUM7UUFFRCxJQUFJLENBQUMsVUFBVSxHQUFHLElBQUksaUJBQVEsQ0FBQyxLQUFLLEVBQUUsZ0JBQWdCLEVBQUU7WUFDdEQsS0FBSztZQUNMLDBFQUEwRTtZQUMxRSxNQUFNLEVBQUUsS0FBSztTQUNkLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxRQUFRLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDckQseUVBQXlFO1FBQ3pFLHdEQUF3RDtRQUN4RCxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUNmLFdBQVcsRUFBRSxFQUFFO1lBQ2YsVUFBVSxFQUFFLEVBQUU7WUFDZCxnQkFBZ0IsRUFBRSxFQUFFO1NBQ3JCLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRTtZQUMvQixNQUFNLEVBQUUsQ0FBQyxlQUFlLENBQUM7WUFDekIsV0FBVyxFQUFFLEVBQUUsUUFBUSxFQUFFLGVBQU0sQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLElBQUksRUFBRTtZQUM5RCxLQUFLLEVBQUU7Z0JBQ0w7b0JBQ0UsSUFBSSxFQUFFLFVBQVU7b0JBQ2hCLElBQUksRUFBRSxxQkFBcUI7b0JBQzNCLHdFQUF3RTtvQkFDeEUsSUFBSSxFQUFFLEVBQUUsYUFBYSxFQUFFLENBQUMsRUFBRTtpQkFDM0I7Z0JBQ0Q7b0JBQ0UsSUFBSSxFQUFFLGtCQUFrQjtvQkFDeEIsR0FBRyxFQUFFO3dCQUNILHNFQUFzRSxPQUFPLGFBQWEsT0FBTyxzQkFBc0I7d0JBQ3ZILHNCQUFzQjt3QkFDdEIsMENBQTBDO3FCQUMzQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUM7aUJBQ2I7Z0JBQ0Q7b0JBQ0UsSUFBSSxFQUFFLGtCQUFrQjtvQkFDeEIsNERBQTREO29CQUM1RCxHQUFHLEVBQUUscUNBQXFDO2lCQUMzQzthQUNGO1NBQ0YsQ0FBQyxDQUFDO0lBQ0wsQ0FBQzs7QUFsRkgsNEJBbUZDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQ29tcG9uZW50LCBUZXh0RmlsZSwgZ2l0aHViLCB0eXBlc2NyaXB0IH0gZnJvbSAncHJvamVuJztcblxuLyoqXG4gKiBPbmUgcGF0aC1zY29wZWQgYWxsb3dsaXN0IGVudHJ5IGZvciB0aGUgZ2VuZXJhdGVkIGAuZ2l0bGVha3MudG9tbGAuXG4gKlxuICogRWFjaCBlbnRyeSBpcyByZW5kZXJlZCBhcyBhIGBbW2FsbG93bGlzdHNdXWAgYmxvY2suIEtlZXAgZXZlcnkgYWxsb3dsaXN0IGFzXG4gKiB0aWdodGx5IHBhdGgtc2NvcGVkIGFzIHBvc3NpYmxlIHNvIGl0IGNhbm5vdCBtYXNrIGEgcmVhbCBzZWNyZXQgZWxzZXdoZXJlIGluXG4gKiB0aGUgcmVwby5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBHaXRsZWFrc0FsbG93bGlzdCB7XG4gIC8qKiBIdW1hbi1yZWFkYWJsZSBkZXNjcmlwdGlvbiBvZiB3aGF0IHRoaXMgYWxsb3dsaXN0IGV4ZW1wdHMgYW5kIHdoeS4gKi9cbiAgcmVhZG9ubHkgZGVzY3JpcHRpb246IHN0cmluZztcbiAgLyoqXG4gICAqIFJlZ2V4IHBhdGhzIHRoZSBhbGxvd2xpc3QgYXBwbGllcyB0byAocmVuZGVyZWQgYXMgZ2l0bGVha3MgYHBhdGhzYCksIGUuZy5cbiAgICogYFsnXlxcXFwubnBtcmMkJ11gLiBPbWl0IHRvIGFwcGx5IHRoZSByZWdleGVzIHJlcG8td2lkZSAoZGlzY291cmFnZWQpLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIG5vIHBhdGggc2NvcGVcbiAgICovXG4gIHJlYWRvbmx5IHBhdGhzPzogc3RyaW5nW107XG4gIC8qKlxuICAgKiBSZWdleGVzIG1hdGNoaW5nIHRoZSBhbGxvd2VkIHNlY3JldCB2YWx1ZXMgKHJlbmRlcmVkIGFzIGdpdGxlYWtzXG4gICAqIGByZWdleGVzYCkuIE9taXQgdG8gYWxsb3cgYW55dGhpbmcgb24gdGhlIHNjb3BlZCBwYXRocy5cbiAgICpcbiAgICogQGRlZmF1bHQgLSBubyB2YWx1ZSByZWdleGVzXG4gICAqL1xuICByZWFkb25seSByZWdleGVzPzogc3RyaW5nW107XG4gIC8qKlxuICAgKiBnaXRsZWFrcyBgY29uZGl0aW9uYCBjb21iaW5pbmcgYHBhdGhzYCBhbmQgYHJlZ2V4ZXNgIChgQU5EYCByZXF1aXJlcyBib3RoKS5cbiAgICpcbiAgICogQGRlZmF1bHQgLSBnaXRsZWFrcyBkZWZhdWx0IChPUilcbiAgICovXG4gIHJlYWRvbmx5IGNvbmRpdGlvbj86IHN0cmluZztcbiAgLyoqXG4gICAqIGdpdGxlYWtzIGByZWdleFRhcmdldGAgKGBzZWNyZXRgIHwgYG1hdGNoYCB8IGBsaW5lYCkuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gZ2l0bGVha3MgZGVmYXVsdFxuICAgKi9cbiAgcmVhZG9ubHkgcmVnZXhUYXJnZXQ/OiBzdHJpbmc7XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgR2l0bGVha3NPcHRpb25zIHtcbiAgLyoqXG4gICAqIFRoZSBnaXRsZWFrcyB2ZXJzaW9uIGRvd25sb2FkZWQgaW4gQ0kuXG4gICAqXG4gICAqIEBkZWZhdWx0ICc4LjMwLjEnXG4gICAqL1xuICByZWFkb25seSB2ZXJzaW9uPzogc3RyaW5nO1xuICAvKipcbiAgICogUGF0aC1zY29wZWQgYWxsb3dsaXN0cyBmb3Iga25vd24gZmFsc2UgcG9zaXRpdmVzLCBhcHBlbmRlZCBhZnRlclxuICAgKiBgW2V4dGVuZF0gdXNlRGVmYXVsdCA9IHRydWVgLlxuICAgKlxuICAgKiBAZGVmYXVsdCBbXVxuICAgKi9cbiAgcmVhZG9ubHkgYWxsb3dsaXN0cz86IEdpdGxlYWtzQWxsb3dsaXN0W107XG59XG5cbi8qKlxuICogZ2l0bGVha3Mgc2VjcmV0LXNjYW5uaW5nIGZvciBhIHByb2plY3Q6IGEgYC5naXRsZWFrcy50b21sYCBjb25maWcgdGhhdCBleHRlbmRzXG4gKiB0aGUgYnVuZGxlZCBkZWZhdWx0IHJ1bGVzZXQgcGx1cyB0aWdodGx5IHBhdGgtc2NvcGVkIGFsbG93bGlzdHMsIGFuZCBhXG4gKiBwdWxsLXJlcXVlc3Qgd29ya2Zsb3cgdGhhdCBzY2FucyB0aGUgZnVsbCBnaXQgaGlzdG9yeSBhZ2FpbnN0IGl0LlxuICpcbiAqIHByb2plbiBoYXMgbm8gbmF0aXZlIGdpdGxlYWtzIGNvbXBvbmVudCwgc28gYm90aCBhcnRpZmFjdHMgYXJlIGdlbmVyYXRlZCBoZXJlXG4gKiB0byBzdGF5IGluIHRoZSBcIm5ldmVyIGhhbmQtZWRpdCBnZW5lcmF0ZWQgZmlsZXNcIiBtb2RlbC4gUmVxdWlyZXMgR2l0SHViIHRvIGJlXG4gKiBlbmFibGVkIG9uIHRoZSBwcm9qZWN0LlxuICovXG5leHBvcnQgY2xhc3MgR2l0bGVha3MgZXh0ZW5kcyBDb21wb25lbnQge1xuXG4gIC8qKiBUaGUgZ2VuZXJhdGVkIGAuZ2l0bGVha3MudG9tbGAuICovXG4gIHB1YmxpYyByZWFkb25seSBjb25maWdGaWxlOiBUZXh0RmlsZTtcblxuICAvKiogVGhlIGdlbmVyYXRlZCBwdWxsLXJlcXVlc3Qgc2Nhbm5pbmcgd29ya2Zsb3cuICovXG4gIHB1YmxpYyByZWFkb25seSB3b3JrZmxvdzogZ2l0aHViLkdpdGh1YldvcmtmbG93O1xuXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiB0eXBlc2NyaXB0LlR5cGVTY3JpcHRQcm9qZWN0LCBvcHRpb25zOiBHaXRsZWFrc09wdGlvbnMgPSB7fSkge1xuICAgIHN1cGVyKHNjb3BlKTtcblxuICAgIGlmICghc2NvcGUuZ2l0aHViKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ0dpdGxlYWtzIHJlcXVpcmVzIEdpdEh1YiB0byBiZSBlbmFibGVkIG9uIHRoZSBwcm9qZWN0Jyk7XG4gICAgfVxuXG4gICAgY29uc3QgdmVyc2lvbiA9IG9wdGlvbnMudmVyc2lvbiA/PyAnOC4zMC4xJztcbiAgICBjb25zdCBhbGxvd2xpc3RzID0gb3B0aW9ucy5hbGxvd2xpc3RzID8/IFtdO1xuXG4gICAgY29uc3QgbGluZXM6IHN0cmluZ1tdID0gW1xuICAgICAgJyMgfn4gR2VuZXJhdGVkIGJ5IHByb2plbi4gVG8gbW9kaWZ5LCBlZGl0IC5wcm9qZW5yYy50cyBhbmQgcnVuIFwibnB4IHByb2plblwiLicsXG4gICAgICAnIycsXG4gICAgICAnIyBnaXRsZWFrcyBjb25maWcuIEV4dGVuZHMgdGhlIGRlZmF1bHQgcnVsZXNldCwgdGhlbiBhZGRzIHRpZ2h0bHkgc2NvcGVkJyxcbiAgICAgICcjIGFsbG93bGlzdHMgZm9yIGtub3duIGZhbHNlIHBvc2l0aXZlcy4gRWFjaCBhbGxvd2xpc3QgaXMgcGF0aC1zY29wZWQgc28gaXQnLFxuICAgICAgJyMgY2Fubm90IG1hc2sgYSByZWFsIHNlY3JldCBlbHNld2hlcmUgaW4gdGhlIHJlcG8uJyxcbiAgICAgICdbZXh0ZW5kXScsXG4gICAgICAndXNlRGVmYXVsdCA9IHRydWUnLFxuICAgIF07XG4gICAgZm9yIChjb25zdCBhIG9mIGFsbG93bGlzdHMpIHtcbiAgICAgIGxpbmVzLnB1c2goJycsIGAjICR7YS5kZXNjcmlwdGlvbn1gLCAnW1thbGxvd2xpc3RzXV0nLCBgZGVzY3JpcHRpb24gPSAke0pTT04uc3RyaW5naWZ5KGEuZGVzY3JpcHRpb24pfWApO1xuICAgICAgaWYgKGEuY29uZGl0aW9uKSB7XG4gICAgICAgIGxpbmVzLnB1c2goYGNvbmRpdGlvbiA9ICR7SlNPTi5zdHJpbmdpZnkoYS5jb25kaXRpb24pfWApO1xuICAgICAgfVxuICAgICAgaWYgKGEucmVnZXhUYXJnZXQpIHtcbiAgICAgICAgbGluZXMucHVzaChgcmVnZXhUYXJnZXQgPSAke0pTT04uc3RyaW5naWZ5KGEucmVnZXhUYXJnZXQpfWApO1xuICAgICAgfVxuICAgICAgaWYgKGEucGF0aHMgJiYgYS5wYXRocy5sZW5ndGggPiAwKSB7XG4gICAgICAgIGxpbmVzLnB1c2goYHBhdGhzID0gWyR7YS5wYXRocy5tYXAoKHApID0+IGAnJycke3B9JycnYCkuam9pbignLCAnKX1dYCk7XG4gICAgICB9XG4gICAgICBpZiAoYS5yZWdleGVzICYmIGEucmVnZXhlcy5sZW5ndGggPiAwKSB7XG4gICAgICAgIGxpbmVzLnB1c2goYHJlZ2V4ZXMgPSBbJHthLnJlZ2V4ZXMubWFwKChyKSA9PiBgJycnJHtyfScnJ2ApLmpvaW4oJywgJyl9XWApO1xuICAgICAgfVxuICAgIH1cblxuICAgIHRoaXMuY29uZmlnRmlsZSA9IG5ldyBUZXh0RmlsZShzY29wZSwgJy5naXRsZWFrcy50b21sJywge1xuICAgICAgbGluZXMsXG4gICAgICAvLyBBIGAvL2Atc3R5bGUgcHJvamVuIG1hcmtlciBpcyBpbnZhbGlkIFRPTUw7IHRoZSBgI2AgbWFya2VyIGlzIGJha2VkIGluLlxuICAgICAgbWFya2VyOiBmYWxzZSxcbiAgICB9KTtcblxuICAgIHRoaXMud29ya2Zsb3cgPSBzY29wZS5naXRodWIuYWRkV29ya2Zsb3coJ2dpdGxlYWtzJyk7XG4gICAgLy8gU2VjcmV0cyBjYW4gbGFuZCBpbiBhbnkgcGF0aCwgc28gbm8gcGF0aCBmaWx0ZXIg4oCUIHBsdXMgbWVyZ2UgcXVldWUgYW5kXG4gICAgLy8gbWFudWFsIGRpc3BhdGNoLCBtYXRjaGluZyB0aGUgcmVwbydzIG90aGVyIHdvcmtmbG93cy5cbiAgICB0aGlzLndvcmtmbG93Lm9uKHtcbiAgICAgIHB1bGxSZXF1ZXN0OiB7fSxcbiAgICAgIG1lcmdlR3JvdXA6IHt9LFxuICAgICAgd29ya2Zsb3dEaXNwYXRjaDoge30sXG4gICAgfSk7XG4gICAgdGhpcy53b3JrZmxvdy5hZGRKb2IoJ2dpdGxlYWtzJywge1xuICAgICAgcnVuc09uOiBbJ3VidW50dS1sYXRlc3QnXSxcbiAgICAgIHBlcm1pc3Npb25zOiB7IGNvbnRlbnRzOiBnaXRodWIud29ya2Zsb3dzLkpvYlBlcm1pc3Npb24uUkVBRCB9LFxuICAgICAgc3RlcHM6IFtcbiAgICAgICAge1xuICAgICAgICAgIG5hbWU6ICdDaGVja291dCcsXG4gICAgICAgICAgdXNlczogJ2FjdGlvbnMvY2hlY2tvdXRAdjQnLFxuICAgICAgICAgIC8vIEZ1bGwgaGlzdG9yeSBzbyBnaXRsZWFrcyBzY2FucyBldmVyeSBjb21taXQgaW4gdGhlIFBSLCBub3QganVzdCBIRUFELlxuICAgICAgICAgIHdpdGg6IHsgJ2ZldGNoLWRlcHRoJzogMCB9LFxuICAgICAgICB9LFxuICAgICAgICB7XG4gICAgICAgICAgbmFtZTogJ0luc3RhbGwgZ2l0bGVha3MnLFxuICAgICAgICAgIHJ1bjogW1xuICAgICAgICAgICAgYGN1cmwgLXNTZkwgaHR0cHM6Ly9naXRodWIuY29tL2dpdGxlYWtzL2dpdGxlYWtzL3JlbGVhc2VzL2Rvd25sb2FkL3Yke3ZlcnNpb259L2dpdGxlYWtzXyR7dmVyc2lvbn1fbGludXhfeDY0LnRhci5neiBcXFxcYCxcbiAgICAgICAgICAgICcgIHwgdGFyIC14eiBnaXRsZWFrcycsXG4gICAgICAgICAgICAnc3VkbyBtdiBnaXRsZWFrcyAvdXNyL2xvY2FsL2Jpbi9naXRsZWFrcycsXG4gICAgICAgICAgXS5qb2luKCdcXG4nKSxcbiAgICAgICAgfSxcbiAgICAgICAge1xuICAgICAgICAgIG5hbWU6ICdTY2FuIGdpdCBoaXN0b3J5JyxcbiAgICAgICAgICAvLyAtLXJlZGFjdCBrZWVwcyBhbnkgcmVhbCBzZWNyZXQgb3V0IG9mIHRoZSBwdWJsaWMgQ0kgbG9ncy5cbiAgICAgICAgICBydW46ICdnaXRsZWFrcyBnaXQgLS1uby1iYW5uZXIgLS1yZWRhY3QgLicsXG4gICAgICAgIH0sXG4gICAgICBdLFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/lib/components/index.d.ts

@@ -1,2 +1,3 @@
 export * from './amplify-deploy';
 export * from './production-release';
+export * from './gitleaks';