Jens
1a055c5534
GeoIntel release gates / Compile, test, contracts and builds (push) Canceled after 0s
GeoIntel release gates / Python and npm vulnerability policy (push) Canceled after 0s
GeoIntel release gates / GIS image, SBOM and container scan (push) Canceled after 0s
GeoIntel release gates / AI image, SBOM and container scan (push) Canceled after 0s
24 lines
899 B
Bash
24 lines
899 B
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
TRUFFLEHOG_IMAGE="ghcr.io/trufflesecurity/trufflehog:3.97.0@sha256:ff4c95e9df7d645daf2140e3ca1039031c63106268d5fbb25feb43ceca1bcc33"
|
|
CONTAINER_ID=""
|
|
|
|
cleanup() {
|
|
if [ -n "$CONTAINER_ID" ]; then
|
|
docker rm -f "$CONTAINER_ID" >/dev/null 2>&1 || true
|
|
fi
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
# Gitea/act jobs themselves run inside a container. A normal `docker run -v
|
|
# "$ROOT:/repo"` therefore asks the host Docker daemon to mount a path that
|
|
# exists only inside the job container. `docker cp` transfers the checked-out
|
|
# tree through the Docker API instead and works in both native and nested jobs.
|
|
CONTAINER_ID="$(docker create "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --no-update --fail)"
|
|
docker cp "$ROOT/." "$CONTAINER_ID:/repo"
|
|
docker start -a "$CONTAINER_ID"
|
|
|
|
echo "Verified-secret scan passed."
|