From f0858916301a5ce67e3486922c5037dbab435ad0 Mon Sep 17 00:00:00 2001 From: Jens Date: Sun, 16 Aug 2026 14:55:37 +0200 Subject: [PATCH] fix(security): add secret-scan step to CI (both .gitea and .github variants) Had a real dependency/container-image Trivy scan but no secret scan. Adds trufflehog (Marketplace Action) as the first step after checkout in both the .gitea/workflows/ and .github/workflows/ copies of this workflow (kept in sync as platform-specific variable-syntax variants of the same pipeline) - the last gap for this repo to count as fully-authored. --- .gitea/workflows/release-gates.yml | 5 +++++ .github/workflows/release-gates.yml | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/.gitea/workflows/release-gates.yml b/.gitea/workflows/release-gates.yml index 1aacc83f..91232c61 100644 --- a/.gitea/workflows/release-gates.yml +++ b/.gitea/workflows/release-gates.yml @@ -21,6 +21,11 @@ jobs: timeout-minutes: 45 steps: - uses: actions/checkout@v4 + - name: Secret scan + uses: trufflesecurity/trufflehog@v3.79.0 + with: + path: ./ + extra_args: --only-verified - uses: actions/setup-python@v5 with: python-version: "3.11" diff --git a/.github/workflows/release-gates.yml b/.github/workflows/release-gates.yml index 8288fc77..c693d91c 100644 --- a/.github/workflows/release-gates.yml +++ b/.github/workflows/release-gates.yml @@ -21,6 +21,11 @@ jobs: timeout-minutes: 45 steps: - uses: actions/checkout@v4 + - name: Secret scan + uses: trufflesecurity/trufflehog@v3.79.0 + with: + path: ./ + extra_args: --only-verified - uses: actions/setup-python@v5 with: python-version: "3.11"