trufflehog.yml

name: TruffleHog Secret Scan

on:
  push:
    branches:
      - main
  pull_request:

permissions:
  contents: read

jobs:
  trufflehog:
    runs-on: ubuntu-latest
    concurrency:
      group: trufflehog-${{ github.ref }}
      cancel-in-progress: false
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
      - name: Secret Scanning (entire repo)
        uses: trufflesecurity/trufflehog@90694bf9af66e7536abc5824e7a87246dbf933cb # v3.88.35
        with:
          base: ""
          head: ${{ github.ref_name }}
          extra_args: --results=verified,unknown