From 6973fe83d076b68db4fe75781bea92712f9e84b8 Mon Sep 17 00:00:00 2001 From: Luc Georges Date: Mon, 10 Jun 2024 10:12:06 +0200 Subject: [PATCH 1/2] feat(ci): add trufflehog secrets detection --- .github/workflows/trufflehog.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 .github/workflows/trufflehog.yml diff --git a/.github/workflows/trufflehog.yml b/.github/workflows/trufflehog.yml new file mode 100644 index 000000000..ba6fdda9b --- /dev/null +++ b/.github/workflows/trufflehog.yml @@ -0,0 +1,21 @@ +on: + push: + +name: Secret Leaks + +permissions: + contents: read + id-token: write + issues: write + pull-requests: write + +jobs: + trufflehog: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + with: + fetch-depth: 0 + - name: Secret Scanning + uses: trufflesecurity/trufflehog@main From 7e23f2a593ae5ff2247f0f2f691c275e09d709bb Mon Sep 17 00:00:00 2001 From: Luc Georges Date: Mon, 10 Jun 2024 10:45:14 +0200 Subject: [PATCH 2/2] fix(ci): remove unnecessary permissions --- .github/workflows/trufflehog.yml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/.github/workflows/trufflehog.yml b/.github/workflows/trufflehog.yml index ba6fdda9b..9cbbf6803 100644 --- a/.github/workflows/trufflehog.yml +++ b/.github/workflows/trufflehog.yml @@ -3,12 +3,6 @@ on: name: Secret Leaks -permissions: - contents: read - id-token: write - issues: write - pull-requests: write - jobs: trufflehog: runs-on: ubuntu-latest