09d73cf413
Pin third-party GitHub Actions to immutable SHA digests to prevent supply chain attacks via tag force-pushing or branch updates. Actions pinned: - trufflesecurity/trufflehog (was @main, now SHA) - sigstore/cosign-installer@v3.8.1 - docker/setup-buildx-action@v3.12.0 - docker/setup-qemu-action@v3.7.0 - docker/login-action@v3.7.0 - goreleaser/goreleaser-action@v6.4.0 - aquasecurity/trivy-action@0.33.1 - github/codeql-action/upload-sarif@v4.32.1 - golangci/golangci-lint-action@v9.2.0 - docker/setup-compose-action@v1.2.0 Version comments added for maintainability.
23 lines
426 B
YAML
23 lines
426 B
YAML
name: "trufflehog"
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- "main"
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
scan:
|
|
runs-on: "ubuntu-latest"
|
|
steps:
|
|
- uses: "actions/checkout@v6"
|
|
with:
|
|
fetch-depth: 0
|
|
submodules: recursive
|
|
- uses: "trufflesecurity/trufflehog@b78fbfd8eb982f4802e09a265fb2bc37b3040975" # main
|
|
with:
|
|
extra_args: "--results=verified,unknown"
|