trufflehog.yml

name: Trufflehog Security Scan
on:
  push:
    branches:
      - master
  pull_request:

jobs:
  trufflehog-vulnerability-detection:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Secret Scanning
        id: trufflehog_scan
        uses: trufflesecurity/trufflehog@v3.82.13
        with:
          path: ./
          base: ""                                                                              # No specific base commit for comparison, scans the entire branch
          head: ${{ github.ref_name }}                                                          # Current branch name
          extra_args: --exclude-detectors uri --exclude-paths .trufflehog/.trufflehogignore.txt --no-verification # Exclude the URI detector and specific files from scanning