From 355323714770a25e7673648fa9b406fce5c16c24 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 5 Aug 2026 07:19:51 +0100 Subject: [PATCH] =?UTF-8?q?fix(ci):=20drop=20the=20leftover=20trufflehog?= =?UTF-8?q?=20step=20=E2=80=94=20the=20estate=20retired=20it=20for=20gitle?= =?UTF-8?q?aks?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit quality.yml carries a trufflehog step that the estate already decided against. The standards secret-scanner reusable records the ruling in its own header: "Rationale for gitleaks over trufflehog: ... Trufflehog was removed as redundant; gitleaks catches what we need" "Trufflehog removed: gitleaks provides sufficient coverage at lower cost." So this is not a coverage trade-off. It is a straggler from before that decision — usually carrying continue-on-error, so it sits inside a check it cannot fail, duplicating a scanner that was deliberately dropped. Removing it loses nothing. This repo keeps gitleaks-backed scanning, which the sweep re-verified from this checkout before touching anything: repos where trufflehog is the ONLY leak scanner were deliberately excluded and need gitleaks ADDED instead, which is a separate change. Gitleaks is also the stronger scan here. It runs over the whole working tree with --no-git and exits non-zero on a finding, where this step passed base..head — a diff is narrower than the tree. The lockfile entry is removed by indentation-aware traversal rather than a line filter. A line filter deletes the dependency key but leaves its indented children, which YAML then attaches to the PRECEDING dependency. The file still parses; the only symptom is every lockfile-checked gate failing with no explanation. That happened once already in this campaign. Co-Authored-By: Claude Fable 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .github/workflows/actions.lock | 6 ------ .github/workflows/quality.yml | 8 -------- 2 files changed, 14 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index d6674fc..402ee55 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -18,7 +18,6 @@ workflows: '.github/workflows/quality.yml': - 'actions/checkout@v7.0.1' - 'editorconfig-checker/action-editorconfig-checker@v2.2.0' - - 'trufflesecurity/trufflehog@v3.96.0' '.github/workflows/rsr-antipattern.yml': - 'actions/checkout@v7.0.1' '.github/workflows/runtime-policy.yml': @@ -58,8 +57,3 @@ dependencies: commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697' owner_id: 18365890 repo_id: 220359305 - 'trufflesecurity/trufflehog@v3.96.0': - ref: 'v3.96.0' - commit: 'sha1-6f3c981e7b77f235fd2702dd74af25fc4b72bf11' - owner_id: 79229934 - repo_id: 77726177 diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index 2df49bd..5d8606e 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -29,14 +29,6 @@ jobs: run: | find . -type f -perm /111 -name "*.sh" | head -10 || true - - name: Check for secrets - uses: trufflesecurity/trufflehog@v3.96.0 - with: - path: ./ - base: ${{ github.event.pull_request.base.sha || github.event.before }} - head: ${{ github.sha }} - continue-on-error: true - - name: Check TODO/FIXME run: | echo "=== TODOs ==="