ci: pin scanner implementation in GitHub mirror

.github/workflows/release-gates.yml

@@ -23,11 +23,8 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           persist-credentials: false
-      - name: Secret scan
+      - name: Verified secret scan
-        uses: trufflesecurity/trufflehog@20652fbbdefffcdaa493a5bf57ab2ac6b1db715b
+        run: bash scripts/scan_secrets.sh
-        with:
-          path: ./
-          extra_args: --only-verified
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: "3.11"
@@ -95,8 +92,14 @@ jobs:
       - name: Audit locked frontend dependencies
         working-directory: frontend
         run: |
+          set +e
           npm ci
-          npm audit --audit-level=high --json > ../artifacts/npm-audit.json
+          install_status="$?"
+          if [ "$install_status" -ne 0 ]; then exit "$install_status"; fi
+          npm audit --audit-level=high --json | tee ../artifacts/npm-audit.json
+          audit_status="${PIPESTATUS[0]}"
+          set -e
+          exit "$audit_status"
       - name: Publish dependency evidence
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02