update docs

Author: anthony-nhs

README.md

@@ -33,6 +33,14 @@ The base image contains
  - asdf
  - aws cli
  - aws sam cli
+ - gitleaks
+ - shellcheck
+ - direnv
+ - yq
+ - zizmor
+ - grype
+ - syft
+ - grant
 
  It installs the following dev container features
  - docker outside of docker
@@ -41,14 +49,10 @@ The base image contains
 As the vscode user the following also happens
 
 asdf install and setup for these so they are available globally as vscode user
- - shellcheck
- - direnv
  - actionlint
  - ruby (for GitHub Pages)
- - yq
 
 Install and setup git-secrets.   
-Install [zizmor](https://github.com/zizmorcore/zizmor).
 
 # Using the images
 ## Project setup
@@ -176,7 +180,7 @@ Check targets (`check.mk`)
 - `cfn-guard-cdk` - validates `cdk.out` against cfn-guard rulesets and writes outputs to `.cfn_guard_out/`
 - `cfn-guard-terraform` - validates `terraform_plans` against cfn-guard rulesets and writes outputs to `.cfn_guard_out/`
 - `actionlint` - runs actionlint against GitHub Actions
-- `secret-scan` - runs git-secrets (including scanning history) against the repository
+- `secret-scan` - runs git-secrets or gitleaks (including scanning history) against the repository
 - `guard-<ENVIRONMENT_VARIABLE>` - checks if an environment variable is set and errors if it is not
 - `zizmor` - runs [zizmor](https://github.com/zizmorcore/zizmor) in the local directory to check github workflows and actions
 - `syft-generate-sbom` - uses syft to generate an sbom in cyclonedx-json format. This *does not* include dev dependencies. Outputs file to .sbom/sbom.cdx.json. 
@@ -369,7 +373,7 @@ CONTAINER_NAME=base \
 
 # Cleaning up unused container images
 
-There is a script to delete unused container images. This runs on every merge to main and deletes pull request images, and on a weekly schedule it deletes images created by CI.   
+There is a script to delete unused container images on github. This runs on every merge to main and deletes pull request images, and on a weekly schedule it deletes images created by CI.   
 You can run it manually using the following. Using the `dry-run` flag just shows what would be deleted
 
 ```

src/base/.devcontainer/Mk/check.mk

@@ -87,7 +87,7 @@ secret-scan:
 	@if [ -f .gitallowed ]; then \
 		git-secrets --scan-history .; \
 	else \
-		gitleaks -v git; \
+		gitleaks -v --redact git; \
 	fi
 
 guard-%: