scan-secrets.yml

name: 🙈 # TODO: Extract into external repository might be reasonable for these public repositories
on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

jobs:
  trufflehog: # 🍄 🐽
    timeout-minutes: 15
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Getting all refs for git mode
      - name: Secret Scanning
        # Okay for using the latest since specified the CLI version below. Consider to pin with a tag if the project looks unstable
        uses: trufflesecurity/trufflehog@39d24534f239563888e7c0d58be0f39112e94b27 # main
        with:
          extra_args: --results=verified,unknown
          version: '3.88.2' # selfup {"extract":"\\d[^']+","replacer":["bash", "-c", "trufflehog --version 2>&1"],"nth":2}