feat: Add Gitleaks v8.18.4 binary to all Dockerfiles

- Dockerfile: Install after system deps, before non-root user
- Dockerfile.complete: Install after TruffleHog (groups secret scanners)
- dast-mvp.dockerfile: Install after Nuclei

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: devatsecure

Dockerfile

@@ -29,6 +29,12 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
+# Install Gitleaks (secret scanner)
+RUN GITLEAKS_VERSION="8.18.4" && \
+    curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_amd64.tar.gz" | \
+    tar xz -C /usr/local/bin gitleaks && \
+    chmod +x /usr/local/bin/gitleaks
+
 # Create non-root user for security
 RUN groupadd -r agentuser && useradd -r -g agentuser -u 1000 agentuser
 

Dockerfile.complete

@@ -24,6 +24,12 @@ RUN wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --
 # Install TruffleHog
 RUN curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin
 
+# Install Gitleaks (secret scanner)
+RUN GITLEAKS_VERSION="8.18.4" && \
+    curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_amd64.tar.gz" | \
+    tar xz -C /usr/local/bin gitleaks && \
+    chmod +x /usr/local/bin/gitleaks
+
 # Install unzip (required for Nuclei)
 RUN apt-get update && apt-get install -y --no-install-recommends \
     unzip \

docker/dast-mvp.dockerfile

@@ -24,6 +24,12 @@ RUN go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest && \
 # Verify Nuclei installation
 RUN nuclei -version
 
+# Install Gitleaks (secret scanner)
+RUN GITLEAKS_VERSION="8.18.4" && \
+    curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_amd64.tar.gz" | \
+    tar xz -C /usr/local/bin gitleaks && \
+    chmod +x /usr/local/bin/gitleaks
+
 # Install ZAP (will use Docker-in-Docker)
 # ZAP will be pulled at runtime via Docker