Bump the actions group across 1 directory with 8 updates #13003
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| on: | |
| # scan the pushed commits, not the whole history: on `pull_request` and on a push to main the action | |
| # derives a base commit, while a bare `push` has none on a new branch and walks every commit ever | |
| # made. if a base is ever set explicitly, pass a sha: a ref name does not resolve in the scanner clone. | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| schedule: | |
| - cron: '0 3 * * 1' # weekly full-history sweep, so history stays in scope | |
| name: Secret Leaks | |
| permissions: | |
| contents: read | |
| jobs: | |
| trufflehog: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| # the scan step mounts this directory, `.git/config` included, into a third-party container | |
| persist-credentials: false | |
| - name: Secret Scanning | |
| uses: trufflesecurity/trufflehog@bcfcf73aaf4759d4dadc2783177c245a02792318 # v3.97.0 | |
| with: | |
| # the action runs the scanner as a container and defaults to the mutable `:latest` tag, so the SHA above | |
| # pins only the wrapper. pin the image by digest too, and bump it together with the action SHA. | |
| version: 3.97.0@sha256:ff4c95e9df7d645daf2140e3ca1039031c63106268d5fbb25feb43ceca1bcc33 | |
| # exclude buggy detectors that cause false positives and are not relevant to our codebase. | |
| # lob matches `(live|test)_[a-zA-Z0-9_]{35}`, which any pytest name of exactly 35 characters after | |
| # `test_` satisfies (e.g. `test_reward_func_wrong_number_of_rewards`). | |
| # without --fail-on-scan-errors, a scan that errors out and covers nothing passes as a scan that found nothing. | |
| extra_args: --results=verified,unknown --exclude-detectors=postgres,lob --fail-on-scan-errors |