From 7dcc3d21acf162142d46da576956fb85fe1a69e7 Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Fri, 27 Mar 2026 12:42:03 +0100 Subject: [PATCH] Use inline trufflehog:ignore instead of exclude paths file Inline comments are more targeted than excluding the entire file from secret scanning. Remove the .trufflehog.yml exclude file and the --exclude-paths flag from the workflow. Signed-off-by: Bryan Frimin --- .github/workflows/secrets.yaml | 2 +- .trufflehog.yml | 1 - pkg/agent/guardrail/sensitive_data_test.go | 8 ++++---- 3 files changed, 5 insertions(+), 6 deletions(-) delete mode 100644 .trufflehog.yml diff --git a/.github/workflows/secrets.yaml b/.github/workflows/secrets.yaml index c0c8d0836..4119da879 100644 --- a/.github/workflows/secrets.yaml +++ b/.github/workflows/secrets.yaml @@ -19,4 +19,4 @@ jobs: submodules: recursive - uses: "trufflesecurity/trufflehog@b78fbfd8eb982f4802e09a265fb2bc37b3040975" # main with: - extra_args: "--results=verified,unknown --exclude-paths=.trufflehog.yml" + extra_args: "--results=verified,unknown" diff --git a/.trufflehog.yml b/.trufflehog.yml deleted file mode 100644 index 58f3205bb..000000000 --- a/.trufflehog.yml +++ /dev/null @@ -1 +0,0 @@ -pkg/agent/guardrail/sensitive_data_test\.go diff --git a/pkg/agent/guardrail/sensitive_data_test.go b/pkg/agent/guardrail/sensitive_data_test.go index fdcd4a31a..f80add522 100644 --- a/pkg/agent/guardrail/sensitive_data_test.go +++ b/pkg/agent/guardrail/sensitive_data_test.go @@ -82,12 +82,12 @@ func TestSensitiveDataGuardrail_Check(t *testing.T) { {"pem certificate", "-----BEGIN CERTIFICATE-----\nMIIE...", true}, // Connection strings - {"postgres uri", "Connect to postgres://user:pass@host/db", true}, - {"postgresql uri", "Connect to postgresql://user:pass@host/db", true}, - {"mongodb uri", "Use mongodb://user:pass@host/db", true}, + {"postgres uri", "Connect to postgres://user:pass@host/db", true}, // trufflehog:ignore + {"postgresql uri", "Connect to postgresql://user:pass@host/db", true}, // trufflehog:ignore + {"mongodb uri", "Use mongodb://user:pass@host/db", true}, // trufflehog:ignore {"mysql uri", "Use mysql://user:pass@host/db", true}, {"redis uri", "Cache at redis://localhost:6379", true}, - {"amqp uri", "Queue at amqp://guest:guest@host/vhost", true}, + {"amqp uri", "Queue at amqp://guest:guest@host/vhost", true}, // trufflehog:ignore // Generic secret field names {"encryption_key", "The encryption_key is set in config", true},