From 22468c1443193f813cb57b0a59cc7f8bdf86b06b Mon Sep 17 00:00:00 2001 From: Pepe Fagoaga Date: Wed, 14 Oct 2026 07:53:25 +0200 Subject: [PATCH] ci(trufflehog): scan full history and pin scanner image (#13032) --- .github/workflows/find-secrets.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/find-secrets.yml b/.github/workflows/find-secrets.yml index 38cbfb6253..19cc3cd217 100644 --- a/.github/workflows/find-secrets.yml +++ b/.github/workflows/find-secrets.yml @@ -38,13 +38,16 @@ jobs: - name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - # PRs only need the diff range; push to master/release walks the new range from event.before. - # 50 is enough headroom for the longest realistic PR/push chain without paying for a full clone. - fetch-depth: 50 + # Full history: a shallow clone cuts the PR's ancestry, git can no longer exclude commits + # already on the base branch, and TruffleHog scans the cut-off commit as a root (the whole + # tree as added). PRs that merge master in hit this and fail on pre-existing content. + fetch-depth: 0 persist-credentials: false - name: Scan diff for secrets with TruffleHog # Action auto-injects --since-commit/--branch from event payload; passing them in extra_args produces duplicate flags. - uses: trufflesecurity/trufflehog@37b77001d0174ebec2fcca2bd83ff83a6d45a3ab # v3.95.3 + uses: trufflesecurity/trufflehog@e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9 # v3.99.2 with: + # The action runs the `latest` image unless told otherwise: pin the scanner to the action's release. + version: 3.99.2@sha256:47a84bc18a0d04a165498bbbd3bacfd84176661cbc91f8e0f85467f6a771e99a extra_args: --results=verified,unknown