From b60b21aad03856ddd8220160297f2fd363738a3c Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@getprobo.com>
Date: Fri, 27 Mar 2026 12:30:36 +0100
Subject: [PATCH] Exclude guardrail test file from TruffleHog secret scanning

The sensitive_data_test.go file contains dummy connection strings
(postgres://, mongodb://, amqp://) used as test fixtures for the data
leak guardrail. These trigger false positives in TruffleHog.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
---
 .github/workflows/secrets.yaml | 2 +-
 .trufflehog.yml                | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)
 create mode 100644 .trufflehog.yml

diff --git a/.github/workflows/secrets.yaml b/.github/workflows/secrets.yaml
index 4119da879..c0c8d0836 100644
--- a/.github/workflows/secrets.yaml
+++ b/.github/workflows/secrets.yaml
@@ -19,4 +19,4 @@ jobs:
           submodules: recursive
       - uses: "trufflesecurity/trufflehog@b78fbfd8eb982f4802e09a265fb2bc37b3040975" # main
         with:
-          extra_args: "--results=verified,unknown"
+          extra_args: "--results=verified,unknown --exclude-paths=.trufflehog.yml"
diff --git a/.trufflehog.yml b/.trufflehog.yml
new file mode 100644
index 000000000..7062cd9ac
--- /dev/null
+++ b/.trufflehog.yml
@@ -0,0 +1,2 @@
+exclude_paths:
+  - "pkg/agent/guardrail/sensitive_data_test.go"