From 350ac3e950f705e0ff37deebf7cf32d8e5ef74c0 Mon Sep 17 00:00:00 2001
From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com>
Date: Fri, 28 Aug 2026 23:57:46 +0200
Subject: [PATCH] fix(ci): run secret scan inside isolated workspace

---
 .gitea/workflows/release-gates.yml | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/release-gates.yml b/.gitea/workflows/release-gates.yml
index 24f4c36b..00243470 100644
--- a/.gitea/workflows/release-gates.yml
+++ b/.gitea/workflows/release-gates.yml
@@ -24,10 +24,19 @@ jobs:
         with:
           fetch-depth: 0
       - name: Secret scan
-        uses: trufflesecurity/trufflehog@v3.79.0
-        with:
-          path: ./
-          extra_args: --only-verified
+        shell: bash
+        run: |
+          set -euo pipefail
+          repository="$PWD"
+          source="file:///repo"
+          workspace=(-v "$repository:/repo" -w /repo)
+          if docker inspect "${HOSTNAME:-}" >/dev/null 2>&1; then
+            source="file://$repository"
+            workspace=(--volumes-from "$HOSTNAME" -w "$repository")
+          fi
+          docker run --rm "${workspace[@]}" \
+            ghcr.io/trufflesecurity/trufflehog@sha256:7104dbb84d1ad2f5f6fa1134e92c6aa6f701f0a4ac2efd5a4c5c96225d899fe3 \
+            git "$source" --fail --no-update --github-actions --only-verified
       - uses: actions/setup-python@v5
         with:
           python-version: "3.11"