fix(ci): run secret scan inside isolated workspace

.gitea/workflows/ci.yml

@@ -13,10 +13,19 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Secret scan
-        uses: trufflesecurity/trufflehog@b9dd330365132cd2d01dd5dc8a857a056a2544e1 # v3.79.0
+        shell: bash
-        with:
+        run: |
-          path: ./
+          set -euo pipefail
-          extra_args: --only-verified
+          repository="$PWD"
+          source="file:///repo"
+          workspace=(-v "$repository:/repo" -w /repo)
+          if docker inspect "${HOSTNAME:-}" >/dev/null 2>&1; then
+            source="file://$repository"
+            workspace=(--volumes-from "$HOSTNAME" -w "$repository")
+          fi
+          docker run --rm "${workspace[@]}" \
+            ghcr.io/trufflesecurity/trufflehog@sha256:7104dbb84d1ad2f5f6fa1134e92c6aa6f701f0a4ac2efd5a4c5c96225d899fe3 \
+            git "$source" --fail --no-update --github-actions --only-verified
       - name: Backend tests in isolated PostgreSQL stack
         run: sh scripts/run-isolated-tests.sh
       - name: Backend static checks