dos-compliance/.github/workflows/devopsshield-ss-trufflehog.yml at main · githubabcs-devops/dos-compliance · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
# Last applied at: Tue, 14 Jan 2025 00:38:20 GMT
# DevOps Shield - The ultimate DevSecOps platform designed to secure your DevOps.
# https://devopsshield.com
##############################################################
# This is a DevOps Shield - Application Security - Code Security Template.

# This workflow template uses actions that are not certified by DevOps Shield.
# They are provided by a third-party and are governed by separate terms of service, privacy policy, and support documentation.

# Use this workflow template for integrating code security into your pipelines and workflows.

# DevOps Shield Workflow Template Details:
# ------------------------------------------------------------
# Code: GH_SS_TRUFFLEHOG
# Name: TruffleHog Secret Scanning
# DevSecOpsControls: SS
# Provider: Truffle Security Co.
# Categories: Code Scanning, Secrets
# Description:
# TruffleHog is the most powerful secrets Discovery, Classification, Validation, and Analysis tool.
# In this context secret refers to a credential a machine uses to authenticate itself to another machine.
# This includes API keys, database passwords, private encryption keys, and more.
# Find, verify, and analyze leaked credentials.
# Read the official documentation to find out more.
# For more information:
# https://trufflesecurity.com/
# https://github.com/trufflesecurity/trufflehog
# ------------------------------------------------------------
# Source repository: https://github.com/trufflesecurity/trufflehog?tab=readme-ov-file#octocat-trufflehog-github-action
##############################################################

name: TruffleHog Secret Scanning

on:
  push:
  pull_request:
  workflow_dispatch:
  schedule:
    - cron: 0 0 * * *

jobs:
  gitleaks:
    name: TruffleHog Secret Scanning

    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0

    - name: Run TruffleHog
      uses: trufflesecurity/trufflehog@v3
      id: trufflehog
      with:
        extra_args: --results=verified,unknown