feat(ci): add trufflehog secrets detection #745
Conversation
.github/workflows/trufflehog.yml
Outdated
| with: | ||
| fetch-depth: 0 |
There was a problem hiding this comment.
Is there a reason to fetch the whole repo history?
There was a problem hiding this comment.
No there isn't 😢
Wdyt of the code here: https://github.com/marketplace/actions/trufflehog-oss#shallow-cloning ?
There was a problem hiding this comment.
Though we could make it so it goes through the whole history if we wanted, cf the actions code: https://github.com/trufflesecurity/trufflehog/blob/3a029ea1932f93109bf9310607ed0f426483a891/action.yml
There was a problem hiding this comment.
Shallow cloning sounds good!
About making it go through the whole history, pretty sure nothing's been merged with secrets ever, but we can run it once if we want (no need to run it every time)
There was a problem hiding this comment.
I just ran trufflehog on the repo and getting a few hf tokens and an AWS access/secret key that are unverified (so I assume rotated).
|
Looks like you used a |
What does this PR do?
Adding a GH action to scan for leaked secrets on each commit.