From f6db2e3cd23bc66f3ca7cca9b8c463cd3753c11c Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 5 Aug 2026 06:53:07 +0100 Subject: [PATCH] =?UTF-8?q?fix(ci):=20drop=20the=20leftover=20trufflehog?= =?UTF-8?q?=20step=20=E2=80=94=20the=20estate=20retired=20it=20for=20gitle?= =?UTF-8?q?aks?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit quality.yml carries a trufflehog step that the estate already decided against. The standards secret-scanner reusable records the ruling in its own header: "Rationale for gitleaks over trufflehog: ... Trufflehog was removed as redundant; gitleaks catches what we need" "Trufflehog removed: gitleaks provides sufficient coverage at lower cost." So this is not a coverage trade-off. It is a straggler from before that decision — usually carrying continue-on-error, so it sits inside a check it cannot fail, duplicating a scanner that was deliberately dropped. Removing it loses nothing. This repo keeps gitleaks-backed scanning, which the sweep re-verified from this checkout before touching anything: repos where trufflehog is the ONLY leak scanner were deliberately excluded and need gitleaks ADDED instead, which is a separate change. Gitleaks is also the stronger scan here. It runs over the whole working tree with --no-git and exits non-zero on a finding, where this step passed base..head — a diff is narrower than the tree. The lockfile entry is removed by indentation-aware traversal rather than a line filter. A line filter deletes the dependency key but leaves its indented children, which YAML then attaches to the PRECEDING dependency. The file still parses; the only symptom is every lockfile-checked gate failing with no explanation. That happened once already in this campaign. Co-Authored-By: Claude Fable 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .github/workflows/quality.yml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index a16fab5..9148145 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -25,13 +25,6 @@ jobs: - name: Check file permissions run: | find . -type f -perm /111 -name "*.sh" | head -10 || true - - name: Check for secrets - uses: trufflesecurity/trufflehog@6f3c981e7b77f235fd2702dd74af25fc4b72bf11 # v3.93.3 - with: - path: ./ - base: ${{ github.event.pull_request.base.sha || github.event.before }} - head: ${{ github.sha }} - continue-on-error: true - name: Check TODO/FIXME run: | echo "=== TODOs ==="