name: 'Tools: TruffleHog'

on:
  push:
    branches:
      - 'master'
      - 'v5.*'
  pull_request:
    branches:
      - 'master'
      - 'v5.*'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  scan-secrets:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          # We can't block as Trufflehog needs to verify secrets against vendors
          egress-policy: audit
          allowed-endpoints: >
            github.com:443
            ghcr.io:443
            pkg-containers.githubusercontent.com:443
            www.formbucket.com:443

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          # Full history: a shallow clone cuts the PR's ancestry, git can no longer exclude commits
          # already on the base branch, and TruffleHog scans the cut-off commit as a root (the whole
          # tree as added). PRs that merge master in hit this and fail on pre-existing content.
          fetch-depth: 0
          persist-credentials: false

      - name: Scan diff for secrets with TruffleHog
        # Action auto-injects --since-commit/--branch from event payload; passing them in extra_args produces duplicate flags.
        uses: trufflesecurity/trufflehog@e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9 # v3.99.2
        with:
          # The action runs the `latest` image unless told otherwise: pin the scanner to the action's release.
          version: 3.99.2@sha256:47a84bc18a0d04a165498bbbd3bacfd84176661cbc91f8e0f85467f6a771e99a
          extra_args: --results=verified,unknown