From 4a0ec6a4955e7f86296d00b2d332045ac2ef9e1e Mon Sep 17 00:00:00 2001
From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com>
Date: Thu, 27 Aug 2026 19:00:11 +0200
Subject: [PATCH] ci: stage secret scan input inside scanner container

---
 .gitea/workflows/quality.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitea/workflows/quality.yml b/.gitea/workflows/quality.yml
index 1e3c757..ed08be5 100644
--- a/.gitea/workflows/quality.yml
+++ b/.gitea/workflows/quality.yml
@@ -16,7 +16,7 @@ jobs:
           set -euo pipefail
           scan_container="$(docker create ghcr.io/trufflesecurity/trufflehog:3.79.0 filesystem /scan --only-verified --fail --no-update)"
           trap 'docker rm -f "${scan_container}" >/dev/null 2>&1 || true' EXIT
-          tar --exclude=.git -cf - . | docker cp - "${scan_container}:/scan"
+          tar --exclude=.git --transform='s#^\.$#scan#;s#^\./#scan/#' -cf - . | docker cp - "${scan_container}:/"
           docker start -a "${scan_container}"
 
   quality: