fix(security): add secret-scan step to backend CI job

Backend job had static checks (ruff/mypy) and a dependency-vulnerability gate but no secret scan; frontend had a dependency audit but no secret scan either. Adds trufflehog once, on the backend job's full checkout, covering the whole repository - the last gap for this repo to count as fully-authored.
2026-08-16 14:54:44 +02:00
parent 6859249570
commit a9f48d6880
1 changed files with 5 additions and 0 deletions
@@ -10,6 +10,11 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
+      - name: Secret scan
+        uses: trufflesecurity/trufflehog@v3.79.0
+        with:
+          path: ./
+          extra_args: --only-verified
      - name: Backend tests in isolated PostgreSQL stack
        run: sh scripts/run-isolated-tests.sh
      - name: Backend static checks