@zuke/security

`@zuke/security` — typed task wrappers for free, open-source security scanners

Symbols

# ActionlintSettings class

class ActionlintSettings extends ToolSettings

Settings for [actionlint](https://github.com/rhysd/actionlint), a linter for GitHub Actions workflow files (and the shell embedded in run: steps).

Member	Signature	Doc
`files`	`files(...paths: PathLike[]): this`	Add an explicit workflow file to lint (positional); repeatable.
`format`	`format(template: string): this`	Output format template (`-format`), e.g. `'{{json .}}'`.
`color`	`color(): this`	Force colored output (`-color`).
`noColor`	`noColor(): this`	Disable colored output (`-no-color`).

# GitleaksDetectSettings class

class GitleaksDetectSettings extends ToolSettings

Settings for [gitleaks detect](https://github.com/gitleaks/gitleaks), which scans a directory (and, by default, git history) for committed secrets.

Member	Signature	Doc
`source`	`source(path: PathLike): this`	Path to scan (`--source`).
`config`	`config(path: PathLike): this`	Use an explicit gitleaks config (`--config`).
`reportFormat`	`reportFormat(value: string): this`	Report format (`--report-format`), e.g. `json`, `sarif`, `csv`.
`reportPath`	`reportPath(path: PathLike): this`	Write the report to a file (`--report-path`).
`redact`	`redact(): this`	Redact secret values from the output (`--redact`).
`noGit`	`noGit(): this`	Treat the source as a plain directory, not a git repo (`--no-git`).
`verbose`	`verbose(): this`	Verbose output (`--verbose`).
`logOpts`	`logOpts(opts: string): this`	Restrict which commits are scanned, passed straight through to `git log` (`--log-opts`). Without this, `gitleaks detect` walks the whole history reachable from the refs present in the checkout — so on a pull request, where CI typically fetches every branch, a secret-shaped string on an unrelated branch fails the scan and the failure appears on whichever pull request is looked at. Passing a range such as `origin/main..HEAD` scopes the scan to the commits under review. Has no effect alongside {@linkcode noGit}, which makes gitleaks treat the source as a plain directory and ignore history entirely.

# OsvScannerSettings class

class OsvScannerSettings extends ToolSettings

Settings for [osv-scanner](https://github.com/google/osv-scanner), which matches lockfile entries against the OSV vulnerability database.

Member	Signature	Doc
`lockfile`	`lockfile(path: PathLike): this`	Scan an explicit lockfile (`--lockfile`); repeatable.
`paths`	`paths(...inputs: PathLike[]): this`	Add a directory to scan (positional); repeatable.
`format`	`format(value: string): this`	Output format (`--format`), e.g. `table`, `json`, `sarif`.
`output`	`output(path: PathLike): this`	Write the report to a file (`--output`).
`recursive`	`recursive(): this`	Recurse into subdirectories (`--recursive`).

# SecurityTasks const

const SecurityTasks: SecurityTasksApi

Task functions for running free, open-source security scanners.

# SecurityTasksApi interface

interface SecurityTasksApi

The shape of SecurityTasks.

Member	Signature	Doc
`zizmor`	`zizmor(configure?: Configure<ZizmorSettings>): Promise<CommandOutput>`	Audit GitHub Actions workflows with `zizmor`.
`actionlint`	`actionlint(configure?: Configure<ActionlintSettings>): Promise<CommandOutput>`	Lint GitHub Actions workflows with `actionlint`.
`gitleaks`	`gitleaks(configure?: Configure<GitleaksDetectSettings>): Promise<CommandOutput>`	Scan for committed secrets with `gitleaks detect`.
`osvScanner`	`osvScanner(configure?: Configure<OsvScannerSettings>): Promise<CommandOutput>`	Scan lockfiles for known vulnerabilities with `osv-scanner`.
`semgrep`	`semgrep(configure?: Configure<SemgrepScanSettings>): Promise<CommandOutput>`	Run source-code static analysis with `semgrep scan`.
`trivyFs`	`trivyFs(configure?: Configure<TrivyFsSettings>): Promise<CommandOutput>`	Scan a filesystem path with `trivy fs`.
`trivyConfig`	`trivyConfig(configure?: Configure<TrivyConfigSettings>): Promise<CommandOutput>`	Scan configuration / IaC files with `trivy config`.

# SemgrepScanSettings class

class SemgrepScanSettings extends ToolSettings

Settings for [semgrep scan](https://github.com/semgrep/semgrep), a static analysis engine for source code. Defaults to whatever rules --config selects (e.g. auto or p/ci).

Member	Signature	Doc
`config`	`config(value: string): this`	Add a rules config (`--config`), e.g. `auto`, `p/ci`; repeatable.
`paths`	`paths(...inputs: PathLike[]): this`	Add a path to scan (positional); repeatable.
`sarif`	`sarif(): this`	Emit SARIF (`--sarif`).
`json`	`json(): this`	Emit JSON (`--json`).
`output`	`output(path: PathLike): this`	Write output to a file (`--output`).
`error`	`error(): this`	Exit non-zero when findings are present (`--error`).

# TrivyConfigSettings class

class TrivyConfigSettings extends TrivyReportSettings

Settings for [trivy config](https://github.com/aquasecurity/trivy), which scans IaC / configuration files (Dockerfiles, workflows, etc.) for misconfigurations.

Member	Signature	Doc
`target`	`target(path: PathLike): this`	The path to scan (default `.`).

# TrivyFsSettings class

class TrivyFsSettings extends TrivyReportSettings

Settings for [trivy fs](https://github.com/aquasecurity/trivy), which scans a filesystem path for vulnerabilities, secrets, and misconfigurations.

Member	Signature	Doc
`target`	`target(path: PathLike): this`	The path to scan (default `.`).
`scanners`	`scanners(...values: string[]): this`	Enable specific scanners (`--scanners`), e.g. `vuln`, `secret`, `misconfig`.

# TrivyReportSettings class

class TrivyReportSettings extends ToolSettings

Shared options for trivy subcommands that produce a report.

Member	Signature	Doc
`format`	`format(value: string): this`	Report format (`--format`), e.g. `table`, `json`, `sarif`.
`output`	`output(path: PathLike): this`	Write the report to a file (`--output`).
`severity`	`severity(...values: string[]): this`	Restrict to these severities (`--severity`), e.g. `HIGH`, `CRITICAL`.
`exitCode`	`exitCode(code: number): this`	Process exit code when issues are found (`--exit-code`).

# ZizmorSettings class

class ZizmorSettings extends ToolSettings

Settings for [zizmor](https://github.com/woodruffw/zizmor), a static analyzer for GitHub Actions workflows (detects unpinned actions, script injection, over-broad permissions, and more).

Member	Signature	Doc
`paths`	`paths(...inputs: PathLike[]): this`	Add a workflow file or directory to audit (positional); repeatable.
`config`	`config(path: PathLike): this`	Use an explicit zizmor config file (`--config`).
`format`	`format(value: string): this`	Output format (`--format`), e.g. `plain`, `json`, or `sarif`.
`minSeverity`	`minSeverity(value: string): this`	Only report findings at or above this severity (`--min-severity`).
`persona`	`persona(value: string): this`	Audit persona (`--persona`), e.g. `regular`, `pedantic`, `auditor`.
`offline`	`offline(): this`	Do not perform any network access (`--offline`).