feat: add secret-scan and trufflehog-scan actions#30

Merged

KlausNie merged 27 commits intomainfrom

feat/security-scan-actions

Mar 31, 2026

Commits on Mar 31, 2026

feat: add secret-scan and trufflehog-scan actions
KlausNie
committed
fix: install trufflehog binary instead of Docker action
KlausNie
committed
fix: install trufflehog to RUNNER_TEMP/bin (writable on k8s runner)
KlausNie
committed
fix: revert to official trufflesecurity/trufflehog Docker action
KlausNie
committed
fix: write safe.directory into container HOME gitconfig
KlausNie
committed
fix: run trufflehog Docker image with explicit workspace mount
KlausNie
committed
fix: use github scanner mode — no volume mount needed
KlausNie
committed
Fix TruffleHog scan to use github scanner mode with PR number
KlausNie
committed
Switch TruffleHog to git subcommand with remote clone
KlausNie
committed
Temporarily remove --only-verified for TruffleHog pattern-match test
KlausNie
committed
Add --no-verification to catch all pattern matches
KlausNie
committed
Add trace logging to debug TruffleHog detection
KlausNie
committed
Restore --only-verified after testing
KlausNie
committed
Emit inline PR annotations for TruffleHog findings
KlausNie
committed
Temporarily tee JSON output for debugging
KlausNie
committed
Remove debug tee, capture TruffleHog output to tempfile only
KlausNie
committed
Fix JSON key lookup to handle both camelCase and capitalized variants
KlausNie
committed
Use recursive search to find file/line in TruffleHog JSON output
KlausNie
committed
Debug: print SourceMetadata structure
KlausNie
committed
Remove debug print
KlausNie
committed
Mount workspace into TruffleHog container instead of pulling via token
KlausNie
committed
Switch TruffleHog to use trufflesecurity/trufflehog@main action
KlausNie
committed
Remove --fail from extra_args, the action already passes it
KlausNie
committed
Revert TruffleHog to remote clone approach
KlausNie
committed
Switch TruffleHog from Docker to downloaded binary
KlausNie
committed
Add artifact signature verification to TruffleHog download
KlausNie
committed
Fix tarball filename for sha256sum verification
KlausNie
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add secret-scan and trufflehog-scan actions#30

feat: add secret-scan and trufflehog-scan actions#30
KlausNie merged 27 commits intomainfrom
feat/security-scan-actions

Commits on Mar 31, 2026

feat: add secret-scan and trufflehog-scan actions

fix: install trufflehog binary instead of Docker action

fix: install trufflehog to RUNNER_TEMP/bin (writable on k8s runner)

fix: revert to official trufflesecurity/trufflehog Docker action

fix: write safe.directory into container HOME gitconfig

fix: run trufflehog Docker image with explicit workspace mount

fix: use github scanner mode — no volume mount needed

Fix TruffleHog scan to use github scanner mode with PR number

Switch TruffleHog to git subcommand with remote clone

Temporarily remove --only-verified for TruffleHog pattern-match test

Add --no-verification to catch all pattern matches

Add trace logging to debug TruffleHog detection

Restore --only-verified after testing

Emit inline PR annotations for TruffleHog findings

Temporarily tee JSON output for debugging

Remove debug tee, capture TruffleHog output to tempfile only

Fix JSON key lookup to handle both camelCase and capitalized variants

Use recursive search to find file/line in TruffleHog JSON output

Debug: print SourceMetadata structure

Remove debug print

Mount workspace into TruffleHog container instead of pulling via token

Switch TruffleHog to use trufflesecurity/trufflehog@main action

Remove --fail from extra_args, the action already passes it

Revert TruffleHog to remote clone approach

Switch TruffleHog from Docker to downloaded binary

Add artifact signature verification to TruffleHog download

Fix tarball filename for sha256sum verification