scan

Scan 🔗

gitleaks() 🔗

Secret scan over the FULL git history. Fails the build on any finding.

gitleaks detect --source /repo --redact --exit-code 1, plus --config /repo/.gitleaks.toml when there is one. --redact keeps the secret out of the logs — a gate that prints what it found publishes it to everyone with read access to the run. --exit-code 1 is what makes it a gate and not a report.

── THE source MUST CARRY A COMPLETE .git ─────────────────────────────── This scans commits, not the working tree. The caller must hand over a directory taken from a fetch-depth: 0 checkout, with .git included (do not add it to a Dagger exclude, and note that actions/checkout inside a job-level container: without git falls back to the API tarball and has no history at all).

A shallow checkout does not fail: gitleaks finds nothing in one commit and exits 0. The gate goes green without having looked at anything, which is strictly worse than not having the gate, because now there is a green tick claiming otherwise. So this function refuses to scan a shallow or git-less directory instead of reporting success on it — that check is the part of ADR-0003 §2.2 that a YAML comment could only ask for politely.

False positives are retired by FINGERPRINT in .gitleaksignore (commit:file:rule:line), which gitleaks reads from the scanned root — so a NEW secret in the same file gets a different fingerprint and still stops the pipeline. Path allowlists in .gitleaks.toml are reserved for machine-generated files (pbxproj, lockfiles) whose fingerprints would need regenerating every week.

Return Type

String !

Arguments

dagger -m github.com/wildbitca/daggerverse/scan@65b66de365f75ca17cb1fe647ffb753c88d4f56f call \
 gitleaks --source DIR_PATH --config string --min-history-depth integercontent_copy Copied! 

func (m *MyModule) Example(ctx context.Context, source *dagger.Directory, config string, minHistoryDepth int) string  {
	return dag.
			Scan().
			Gitleaks(ctx, source, config, minHistoryDepth)
}content_copy Copied!

@function
async def example(source: dagger.Directory, config: str, minhistorydepth: int) -> str:
	return await (
		dag.scan()
		.gitleaks(source, config, minhistorydepth)
	)content_copy Copied!

@func()
async example(source: Directory, config: string, minHistoryDepth: number): Promise<string> {
	return dag
		.scan()
		.gitleaks(source, config, minHistoryDepth)
}content_copy Copied!

trivy() 🔗

Vulnerability scan of a container image, fail-closed BEFORE it is published.

trivy image --input /image.tar --severity CRITICAL,HIGH --ignore-unfixed --pkg-types library --exit-code 1 --format table — the invocation ADR-0003 §2.2 pins, character for character, on aquasec/trivy:0.58.0.

⚠️ The binary is named explicitly in the exec. Dagger’s withExec does not use the container’s ENTRYPOINT, so ["image", "--input", …] would run image as a command and fail with something that reads like a Trivy usage error rather than a Dagger one. This is already how pacha-api’s module does it, and the comment there exists for the same reason.

── WHY THE INVOCATION IS SHAPED LIKE THAT ────────────────────────────────── --pkg-types library scopes the gate to OUR dependencies, the ones a bump in this repo can actually fix. Base-image OS CVEs (distroless/debian) are only closed by Google bumping the base, so gating on them is a build stuck red on something nobody here can move; they are covered post-publish by Artifact Registry’s Artifact Analysis, which is enabled on both pacha projects and produces live findings. --ignore-unfixed is the same idea for the rest: a CVE with no fix available is not an action.

It runs BEFORE the push, against the local tarball, because an image with a critical CVE that already reached the registry can be deployed by anyone.

⚠️ A run is cached on the CONTENT of the image. Scanning the same digest two weeks later replays the old verdict without re-downloading the vulnerability DB, so this gate answers “was this image clean when it was built”, not “is it clean today”. Rescanning what is already published is Artifact Analysis’ job, by design (ADR-0003 §7.2) — no cache-buster is offered here, because a knob the caller must remember to set is a gate that fails open by omission.

Return Type

String !

Arguments

dagger -m github.com/wildbitca/daggerverse/scan@65b66de365f75ca17cb1fe647ffb753c88d4f56f call \
 trivycontent_copy Copied! 

func (m *MyModule) Example(ctx context.Context) string  {
	return dag.
			Scan().
			Trivy(ctx)
}content_copy Copied!

@function
async def example() -> str:
	return await (
		dag.scan()
		.trivy()
	)content_copy Copied!

@func()
async example(): Promise<string> {
	return dag
		.scan()
		.trivy()
}content_copy Copied!