fix(ci): drop the leftover trufflehog step — the estate retired it for gitleaks

[hyperpolymath]

quality.yml carries a trufflehog step that the estate already decided against.

The standards secret-scanner reusable records the ruling in its own header:

"Rationale for gitleaks over trufflehog: … Trufflehog was removed as redundant; gitleaks catches what we need"
"Trufflehog removed: gitleaks provides sufficient coverage at lower cost."

So this is not a coverage trade-off. It is a straggler from before that decision — usually carrying continue-on-error: true, so it sits inside a check it cannot fail, duplicating a scanner that was deliberately dropped.

Removing it loses nothing

This repo keeps gitleaks-backed scanning, and the sweep re-verified that from this checkout before touching anything. Repos where trufflehog is the only leak scanner were deliberately excluded — 33 of them estate-wide — because they need gitleaks added, which is a different change and must not be disguised as this one.

Gitleaks is also the stronger scan here: it runs over the whole working tree with --no-git and exits non-zero on a finding, whereas this step scanned base..head. A diff is narrower than the tree.

Estate coverage, measured

Across 364 repositories with workflows (60 more have none at all):

	count
gitleaks only	170 (47%)	correct
trufflehog and gitleaks	73 (20%)	this PR's category — straggler removal
trufflehog only	33 (9%)	must gain gitleaks first — excluded here
neither	88 (24%)	no leak scanning at all

A note on the lockfile edit

The actions.lock entry is removed by indentation-aware traversal, not a line filter.

A line filter deletes the dependency key but leaves its four indented children, which YAML then attaches to the preceding dependency. The file still parses as valid YAML — the only symptom is every lockfile-checked gate failing startup_failure with no explanation. That happened once already in this campaign, on three repos at once, and is why this sweep asserts every remaining dependency still carries its own commit field before committing.

Found during the 2026-08-05 estate CI/CD census.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

CI failed: CI build failure due to 29 files containing unfilled {{PLACEHOLDER}} tokens caught by scripts/check-no-placeholders.sh.

Overview

1 failure pattern found across 1 analyzed log. The build failed because the repository contains unfilled placeholder tokens in multiple configuration and documentation files.

Failures

Unfilled Placeholder Tokens in Repository Files (confidence: high)

• Type: build
• Affected jobs: 92221119716
• Related to change: unclear
• Root cause: The script scripts/check-no-placeholders.sh detected 29 files containing unfilled {{PLACEHOLDER}} tokens (such as .github/CODEOWNERS, .github/CODE_OF_CONDUCT.md, etc.), violating the policy that all tokens must be filled or removed.
• Suggested fix: Run repository initialization or replace/remove the unfilled {{PLACEHOLDER}} tokens in the affected files.

Summary

• Change-related failures: 0
• Infrastructure/flaky failures: 0
• Recommended action: Populate or remove the unfilled {{PLACEHOLDER}} tokens across the 29 flagged files so that scripts/check-no-placeholders.sh passes.

Code Review ✅ Approved

Removes the redundant trufflehog step from quality.yml workflow to align with the estate-wide transition to gitleaks. No issues found.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}