gitleaks/gitleaks · error

template path cannot be empty

Error message

template path cannot be empty

What it means

The template reporter (report/template.go) renders findings through a Go text/template loaded from a user-supplied file; NewTemplateReporter requires a non-empty path because there is no default template to fall back on. It is invoked when report-format template is selected, so an empty --report-template is always a caller mistake, and the empty check runs before os.ReadFile would produce a confusing 'no such file' error.

Source

Thrown at report/template.go:21

import (
	"errors"
	"fmt"
	"io"
	"os"
	"text/template"

	"github.com/Masterminds/sprig/v3"
)

type TemplateReporter struct {
	template *template.Template
}

var _ Reporter = (*TemplateReporter)(nil)

func NewTemplateReporter(templatePath string) (*TemplateReporter, error) {
	if templatePath == "" {
		return nil, errors.New("template path cannot be empty")
	}

	file, err := os.ReadFile(templatePath)
	if err != nil {
		return nil, fmt.Errorf("error reading file: %w", err)
	}
	templateText := string(file)

	// TODO: Add helper functions like escaping for JSON, XML, etc.
	t := template.New("custom")

	funcMap := sprig.TxtFuncMap()
	delete(funcMap, "env")
	delete(funcMap, "expandenv")
	delete(funcMap, "getHostByName")

	t = t.Funcs(funcMap)
	t, err = t.Parse(templateText)

View on GitHub (pinned to b58d3f102c)

Solutions

1. Pass a template file: --report-template=report.tmpl alongside --report-format template.
2. Create the template using text/template syntax; sprig functions are available (funcMap is sprig.TxtFuncMap).
3. If you did not want a custom layout, switch back to --report-format json, sarif, csv, or junit.

Example fix

# before
gitleaks detect --source . --report-format template --report-path out.txt

# after
gitleaks detect --source . --report-format template --report-template=./report.tmpl --report-path out.txt

# bash: require the template file when template format is selected
if [[ "$REPORT_FORMAT" == "template" ]]; then
  [[ -n "$REPORT_TEMPLATE" && -f "$REPORT_TEMPLATE" ]] || { echo "error: --report-template <file> is required for template format" >&2; exit 2; }
fi
gitleaks detect --source . --report-format="$REPORT_FORMAT" --report-template="${REPORT_TEMPLATE:-}" --report-path=out.txt

When it happens

Trigger: Running gitleaks git/detect with --report-format template but omitting --report-template; passing an empty string via an unset environment variable interpolated into the CLI invocation.

Common situations: CI pipelines that copy a report-format=template line from docs without the companion --report-template flag; scripts where the template path variable is conditionally empty; switching from json format and forgetting the extra required flag.

Related errors

• invalid scm platform value: %s
• the diagnostics directory should not be set in http mode
• other diagnostics modes should not be enabled when http mode
• must contain at least one check for: commits, paths, regexes
• unable to load config due to extend.path and extend.useDefau

AI-assisted analysis of gitleaks/gitleaks@b58d3f102c (2026-08-15). Data as JSON: /api/errors/1e2e4b6203db5bdb. Report an issue: GitHub.