ci: Lean via elan in ECHIDNA + drop duplicate trufflehog --fail #418

	# SPDX-License-Identifier: MPL-2.0
	name: Secret Scanner
	on:
	pull_request:
	push:
	branches: [main]
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true
	permissions:
	contents: read
	jobs:
	scan:
	# The reusable workflow's gitleaks job elevates to these permissions;
	# a called workflow cannot exceed the caller's grant, so they must be
	# granted here or the run dies with startup_failure.
	permissions:
	contents: read
	pull-requests: write
	actions: read
	uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
	secrets: inherit
	trufflehog:
	runs-on: ubuntu-latest
	timeout-minutes: 15
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
	with:
	fetch-depth: 0
	- name: TruffleHog Secret Scan
	uses: trufflesecurity/trufflehog@00155c9dc586f34d189adc83d3ac2698c2ec551f # v3.93.3
	with:
	# The action already appends `--fail` internally; repeating it here
	# makes the trufflehog binary abort with "flag 'fail' cannot be
	# repeated". Pass only `--only-verified`.
	extra_args: --only-verified

Provide feedback