ci: run secret scan without nested bind mounts

2026-08-27 18:48:51 +02:00
parent d8ee5d605c
commit a4e006f455
1 changed files with 7 additions and 4 deletions
@@ -11,10 +11,13 @@ jobs:
    steps:
      - uses: actions/checkout@v4
      - name: Secret scan
-        uses: trufflesecurity/trufflehog@v3.79.0
-        with:
-          path: ./
-          extra_args: --only-verified
+        shell: bash
+        run: |
+          set -euo pipefail
+          scan_container="$(docker create ghcr.io/trufflesecurity/trufflehog:3.79.0 filesystem /scan --only-verified --fail --no-update)"
+          trap 'docker rm -f "${scan_container}" >/dev/null 2>&1 || true' EXIT
+          tar --exclude=.git -cf - . | docker cp - "${scan_container}:/scan"
+          docker start -a "${scan_container}"

  quality:
    # Browser quality runs against the dedicated bounded Windows 11 VM runner.