From a414ae3e8ac5d7b0845140e4862f75fa7e2314d7 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 21 Jul 2026 07:26:58 +0100 Subject: [PATCH] fix(ci): drop the retired inline trufflehog job MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit secret-scanner-reusable.yml deliberately retired TruffleHog as redundant ("gitleaks provides sufficient coverage at lower cost" — see the reusable's header). The inline job survived here, fails, and turns the whole Secret Scanner workflow red even though gitleaks, rust-secrets and shell-secrets all pass — so the repo keeps emitting ci_activity notifications. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/secret-scanner.yml | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 9d618e4..23d6e39 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -20,17 +20,3 @@ jobs: actions: read uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 secrets: inherit - trufflehog: - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4 - with: - fetch-depth: 0 - - name: TruffleHog Secret Scan - uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # v3.93.3 - with: - # The action already appends `--fail` internally; repeating it here - # makes the trufflehog binary abort with "flag 'fail' cannot be - # repeated". Pass only `--only-verified`. - extra_args: --only-verified