Bryan Frimin
bc51c910ae
Rename TruffleHog exclude paths file to plain text
...
The --exclude-paths flag expects a plain text file with one regex
per line, not a YAML file.
Signed-off-by: Bryan Frimin <bryan@getprobo.com >
2026-03-30 14:18:29 +02:00
Bryan Frimin
5237e57d27
Revert "Use inline trufflehog:ignore instead of exclude paths file"
...
This reverts commit f10ecb8210b1176311d9372d1108b91ce8290fd4.
Signed-off-by: Bryan Frimin <bryan@getprobo.com >
2026-03-30 14:18:29 +02:00
Bryan Frimin
7dcc3d21ac
Use inline trufflehog:ignore instead of exclude paths file
...
Inline comments are more targeted than excluding the entire file
from secret scanning. Remove the .trufflehog.yml exclude file and
the --exclude-paths flag from the workflow.
Signed-off-by: Bryan Frimin <bryan@getprobo.com >
2026-03-30 14:18:29 +02:00
Bryan Frimin
b60b21aad0
Exclude guardrail test file from TruffleHog secret scanning
...
The sensitive_data_test.go file contains dummy connection strings
(postgres://, mongodb://, amqp://) used as test fixtures for the data
leak guardrail. These trigger false positives in TruffleHog.
Signed-off-by: Bryan Frimin <bryan@getprobo.com >
2026-03-30 14:18:29 +02:00
mendral-app[bot]
09d73cf413
chore: pin all third-party actions to SHA digests
...
Pin third-party GitHub Actions to immutable SHA digests to prevent
supply chain attacks via tag force-pushing or branch updates.
Actions pinned:
- trufflesecurity/trufflehog (was @main, now SHA)
- sigstore/cosign-installer@v3.8.1
- docker/setup-buildx-action@v3.12 .0
- docker/setup-qemu-action@v3.7.0
- docker/login-action@v3.7.0
- goreleaser/goreleaser-action@v6.4.0
- aquasecurity/trivy-action@0.33 .1
- github/codeql-action/upload-sarif@v4.32 .1
- golangci/golangci-lint-action@v9.2.0
- docker/setup-compose-action@v1.2.0
Version comments added for maintainability.
2026-02-05 08:28:22 +01:00
dependabot[bot]
b88a6ba012
Bump the github-actions group with 10 updates
...
Bumps the github-actions group with 10 updates:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout ) | `4` | `6` |
| [actions/setup-go](https://github.com/actions/setup-go ) | `5` | `6` |
| [actions/setup-node](https://github.com/actions/setup-node ) | `4` | `6` |
| [actions/cache](https://github.com/actions/cache ) | `4` | `5` |
| [anchore/sbom-action](https://github.com/anchore/sbom-action ) | `0.20.5` | `0.22.1` |
| [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) | `0.28.0` | `0.33.1` |
| [anchore/scan-action](https://github.com/anchore/scan-action ) | `6.5.1` | `7.3.1` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact ) | `4` | `6` |
| [actions/attest-sbom](https://github.com/actions/attest-sbom ) | `1` | `3` |
| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance ) | `1` | `3` |
Updates `actions/checkout` from 4 to 6
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v4...v6 )
Updates `actions/setup-go` from 5 to 6
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/v5...v6 )
Updates `actions/setup-node` from 4 to 6
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/v4...v6 )
Updates `actions/cache` from 4 to 5
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/v4...v5 )
Updates `anchore/sbom-action` from 0.20.5 to 0.22.1
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](da167eac91...deef08a0dbhttps://github.com/aquasecurity/trivy-action/releases )
- [Commits](https://github.com/aquasecurity/trivy-action/compare/0.28.0...0.33.1 )
Updates `anchore/scan-action` from 6.5.1 to 7.3.1
- [Release notes](https://github.com/anchore/scan-action/releases )
- [Changelog](https://github.com/anchore/scan-action/blob/main/RELEASE.md )
- [Commits](1638637db6...8d2fce0942https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v6 )
Updates `actions/attest-sbom` from 1 to 3
- [Release notes](https://github.com/actions/attest-sbom/releases )
- [Changelog](https://github.com/actions/attest-sbom/blob/main/RELEASE.md )
- [Commits](https://github.com/actions/attest-sbom/compare/v1...v3 )
Updates `actions/attest-build-provenance` from 1 to 3
- [Release notes](https://github.com/actions/attest-build-provenance/releases )
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md )
- [Commits](https://github.com/actions/attest-build-provenance/compare/v1...v3 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: actions/setup-go
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: actions/setup-node
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: actions/cache
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: anchore/sbom-action
dependency-version: 0.22.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
- dependency-name: aquasecurity/trivy-action
dependency-version: 0.33.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
- dependency-name: anchore/scan-action
dependency-version: 7.3.1
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: actions/upload-artifact
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: actions/attest-sbom
dependency-version: '3'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: actions/attest-build-provenance
dependency-version: '3'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-01 21:14:12 +00:00
Émile Ré
81cb0de8f2
Update github workflows
...
Signed-off-by: Émile Ré <nemile.re@gmail.com >
2025-12-15 18:24:00 +01:00
Sacha Al Himdani
ce613ca453
Change trufflehog workflow permission
...
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com >
2025-09-16 10:17:59 +02:00
Bryan Frimin
cc354cd9c5
Add secret scanning
...
Signed-off-by: Bryan Frimin <bryan@getprobo.com >
2025-09-14 14:18:48 +02:00
