From c2699e3ffb97a389e063df59a42260c35eec24f9 Mon Sep 17 00:00:00 2001
From: Enes1998 <104234112+Enes1998@users.noreply.github.com>
Date: Sun, 7 Jun 2026 22:33:20 +0200
Subject: [PATCH] ci: make TruffleHog scan merges + opt actions into Node 24

- TruffleHog used base=default_branch + head=HEAD, so on push/merge to main base==head
  and it scanned NOTHING (only PRs were scanned). Use the PR diff on pull_request and
  the pushed before..after range on push, so merges to main are actually scanned.
- Add FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true so Node20-based actions run on Node24
  (GitHub force-migrates 2026-06-16), clearing the deprecation warnings.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 45d2ce8..7815743 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,6 +13,11 @@ permissions:
   security-events: write
   packages: write
 
+# Run Node20-based actions on Node24 (GitHub force-migrates 2026-06-16). Silences the
+# deprecation warnings and future-proofs the workflow.
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
 jobs:
   secret-scan:
     name: Secret Scan (TruffleHog)
@@ -27,8 +32,11 @@ jobs:
         uses: trufflesecurity/trufflehog@main
         with:
           path: ./
-          base: ${{ github.event.repository.default_branch }}
-          head: HEAD
+          # On a PR: scan the PR diff. On a push/merge to main: scan the pushed range
+          # (before..after). The previous default-branch/HEAD config made base==head on
+          # main pushes, so TruffleHog scanned nothing.
+          base: ${{ github.event.pull_request.base.sha || github.event.before }}
+          head: ${{ github.event.pull_request.head.sha || github.sha }}
           extra_args: --results=verified,unknown
 
   quality: