Skip to content

ci(security): pin trufflesecurity/trufflehog@v3.88.18 #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
gapview01 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci(security): pin trufflesecurity/trufflehog@v3.88.18 #4

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ jobs:
with:
fetch-depth: 0
- name: Secret scan
uses: trufflesecurity/trufflehog@main
uses: trufflesecurity/trufflehog@v3.88.18
with:
extra_args: --only-verified
Comment on lines +89 to 91
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Pin the TruffleHog CLI image as well

This pins the composite action wrapper, but the v3.88.18 action still defaults its version input to latest and runs ghcr.io/trufflesecurity/trufflehog:${VERSION}; I checked https://raw.githubusercontent.com/trufflesecurity/trufflehog/v3.88.18/action.yml. In the security/secrets job, because no version: is supplied under with:, CI will continue pulling the mutable trufflehog:latest image, so the 502/immutability risk this commit is meant to remove remains. Add version: 3.88.18 (or another pinned image tag) alongside extra_args.

Useful? React with 👍 / 👎.


Expand Down
Loading