Add trufflehog workflow to secret scan (#313)

* Add trufflehog workflow to secret scan * Add pre-push git hook to scan code with trufflehog. * Make pre-commit hook executable. * Pin to version 3.14.0 Co-authored-by: Ariful Haque <[email protected]>
HO-CTO · Oct 18, 2022 · db2323a · db2323a
1 parent ef32705
commit db2323a
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/.githooks/pre-push b/.githooks/pre-push
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+REPO_ROOT_DIR=$(git rev-parse --show-toplevel)
+
+docker run --rm -v "$REPO_ROOT_DIR:/app" trufflesecurity/trufflehog:3.14.0 git file:///app --only-verified --no-update --fail
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
@@ -15,4 +15,12 @@ jobs:
       - name: gitleaks-action
         uses: gitleaks/[email protected]
         with:
-          config-path: security/.gitleaks.toml
+          config-path: security/.gitleaks.toml
+
+      - name: TruffleHog OSS
+        uses: trufflesecurity/[email protected]
+        with:
+          path: ./
+          base: ${{ github.event.repository.default_branch }}
+          head: HEAD
+          extra_args: --debug --only-verified --no-update