From a4e006f455511fe9d6f14c03ced0c78b6c2fd29b Mon Sep 17 00:00:00 2001
From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com>
Date: Thu, 27 Aug 2026 18:48:51 +0200
Subject: [PATCH] ci: run secret scan without nested bind mounts

---
 .gitea/workflows/quality.yml | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/quality.yml b/.gitea/workflows/quality.yml
index 2e60c52..1e3c757 100644
--- a/.gitea/workflows/quality.yml
+++ b/.gitea/workflows/quality.yml
@@ -11,10 +11,13 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Secret scan
-        uses: trufflesecurity/trufflehog@v3.79.0
-        with:
-          path: ./
-          extra_args: --only-verified
+        shell: bash
+        run: |
+          set -euo pipefail
+          scan_container="$(docker create ghcr.io/trufflesecurity/trufflehog:3.79.0 filesystem /scan --only-verified --fail --no-update)"
+          trap 'docker rm -f "${scan_container}" >/dev/null 2>&1 || true' EXIT
+          tar --exclude=.git -cf - . | docker cp - "${scan_container}:/scan"
+          docker start -a "${scan_container}"
 
   quality:
     # Browser quality runs against the dedicated bounded Windows 11 VM runner.