Repository navigation
ci: replace gitleaks with trufflehog - #872
Merged
Merged
Conversation
Same scope as before: the commits between the base and the head of each PR (and push, where gitleaks ran on push). --no-verification, so every candidate fails the job and nothing is sent to provider APIs; findings print as detector + file:line only. False positives: `trufflehog:ignore` after the value on its line, or a path regex in .trufflehogignore. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PRs only scan their own commits, so the old cassette lines are never scanned; excluding the files would only hide a key in a re-recorded cassette. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces gitleaks with TruffleHog, matching HumanSignal/hs-platform#3611.
What changes
.github/workflows/gitleaks.yml→.github/workflows/trufflehog.yml. Same scope as before: the commits of each PR (the job only runs on `pull_request`).--no-verification: candidates are never sent to provider APIs, so every hit fails the job. Findings print as detector +file:line+ commit only; the raw JSON (which holds the values) is not uploaded.git merge-base base head: TruffleHog's--since-commitmust be an ancestor of the head, otherwise it scans nothing and reports success.False positives: add
trufflehog:ignoreon the line after the value (it is ignored before it), or a path regex in a.trufflehogignorefile (the workflow passes it when present).Checked: actionlint clean; the scan step was run locally against this repo's last 30 commits on the default branch, and against a synthetic repo (planted token → fails with its location; ignored path → passes; new branch with zero base → skips).
🤖 Generated with Claude Code