From a0044fa7d6601e6aad485b8e022e560a41c08419 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 5 Aug 2026 06:52:06 +0100 Subject: [PATCH] =?UTF-8?q?fix(ci):=20drop=20the=20leftover=20trufflehog?= =?UTF-8?q?=20step=20=E2=80=94=20the=20estate=20retired=20it=20for=20gitle?= =?UTF-8?q?aks?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit quality.yml carries a trufflehog step that the estate already decided against. The standards secret-scanner reusable records the ruling in its own header: "Rationale for gitleaks over trufflehog: ... Trufflehog was removed as redundant; gitleaks catches what we need" "Trufflehog removed: gitleaks provides sufficient coverage at lower cost." So this is not a coverage trade-off. It is a straggler from before that decision — usually carrying continue-on-error, so it sits inside a check it cannot fail, duplicating a scanner that was deliberately dropped. Removing it loses nothing. This repo keeps gitleaks-backed scanning, which the sweep re-verified from this checkout before touching anything: repos where trufflehog is the ONLY leak scanner were deliberately excluded and need gitleaks ADDED instead, which is a separate change. Gitleaks is also the stronger scan here. It runs over the whole working tree with --no-git and exits non-zero on a finding, where this step passed base..head — a diff is narrower than the tree. The lockfile entry is removed by indentation-aware traversal rather than a line filter. A line filter deletes the dependency key but leaves its indented children, which YAML then attaches to the PRECEDING dependency. The file still parses; the only symptom is every lockfile-checked gate failing with no explanation. That happened once already in this campaign. Co-Authored-By: Claude Fable 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .github/workflows/actions.lock | 6 ------ .github/workflows/quality.yml | 7 ------- 2 files changed, 13 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 8d44d37..fb40d90 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -42,7 +42,6 @@ workflows: '.github/workflows/quality.yml': - 'actions/checkout@v7.0.1' - 'editorconfig-checker/action-editorconfig-checker@v2.2.0' - - 'trufflesecurity/trufflehog@v3.96.0' '.github/workflows/release.yml': - 'actions/attest-build-provenance@v4.1.1' - 'actions/checkout@v7.0.1' @@ -169,8 +168,3 @@ dependencies: commit: 'sha1-22918119ff8e1ca75a623e15c8296b6ea4fbe28f' owner_id: 545988 repo_id: 366408409 - 'trufflesecurity/trufflehog@v3.96.0': - ref: 'v3.96.0' - commit: 'sha1-6f3c981e7b77f235fd2702dd74af25fc4b72bf11' - owner_id: 79229934 - repo_id: 77726177 diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index d0cda86..6952d2b 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -26,13 +26,6 @@ jobs: - name: Check file permissions run: | find . -type f -perm /111 -name "*.sh" | head -10 || true - - name: Check for secrets - uses: trufflesecurity/trufflehog@v3.96.0 - with: - path: ./ - base: ${{ github.event.pull_request.base.sha || github.event.before }} - head: ${{ github.sha }} - continue-on-error: true - name: Check TODO/FIXME run: | echo "=== TODOs ==="