fix(ci): run secret scan inside isolated workspace

2026-08-28 23:57:46 +02:00
parent d20ff7a243
commit 00e8ec001b
1 changed files with 13 additions and 4 deletions
@@ -13,10 +13,19 @@ jobs:
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - name: Secret scan
-        uses: trufflesecurity/trufflehog@b9dd330365132cd2d01dd5dc8a857a056a2544e1 # v3.79.0
-        with:
-          path: ./
-          extra_args: --only-verified
+        shell: bash
+        run: |
+          set -euo pipefail
+          repository="$PWD"
+          source="file:///repo"
+          workspace=(-v "$repository:/repo" -w /repo)
+          if docker inspect "${HOSTNAME:-}" >/dev/null 2>&1; then
+            source="file://$repository"
+            workspace=(--volumes-from "$HOSTNAME" -w "$repository")
+          fi
+          docker run --rm "${workspace[@]}" \
+            ghcr.io/trufflesecurity/trufflehog@sha256:7104dbb84d1ad2f5f6fa1134e92c6aa6f701f0a4ac2efd5a4c5c96225d899fe3 \
+            git "$source" --fail --no-update --github-actions --only-verified
      - name: Backend tests in isolated PostgreSQL stack
        run: sh scripts/run-isolated-tests.sh
      - name: Backend static checks