PDP-1182 fix: TruffleHog scan failure on private repos (persist-credentials hotfix)

[GAdityaVarma]

Hotfix: Fixes TruffleHog scan failure on private repos introduced in PR #42.

Root Cause

PR #42 added persist-credentials: false to the checkout step in trufflehog-scan.yml. This is correct security hardening for public repos, but on private repos (like MarkLogic-Builds), the subsequent git fetch origin step fails because no credentials are stored in .git/config to authenticate with the private remote.

Fix

Temporarily configure git's http.extraheader with the GITHUB_TOKEN for the fetch step only, then immediately remove it:

1. Set extraheader with base64-encoded x-access-token:$GH_TOKEN
2. Run git fetch origin (now succeeds on private repos)
3. Remove extraheader immediately after

This ensures:

• persist-credentials: false remains (hardened checkout)
• git fetch works for both public and private repos
• Credentials are NOT available when PR code is checked out in later steps (Parse scan results)

Impact

• Fixes: TruffleHog scan on all private repos in the marklogic org
• Tested against: Public repos (no regression expected since auth is only added/removed around the fetch)

Tested in private PR: https://github.com/marklogic/MarkLogic-Builds/pull/1371 looks good. test workflow with git -c auth pattern works on private repo.

[Copilot]

Pull request overview

Hotfix to restore TruffleHog scanning on private repositories while keeping actions/checkout hardened with persist-credentials: false, by temporarily injecting Git HTTP auth for the git fetch that retrieves PR head refs.

Changes:

• Adds a temporary http.*.extraheader Authorization header using github.token to authenticate the git fetch origin step on private repos.
• Unsets the temporary git auth header after fetching PR head commits.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[SameeraPriyathamTadikonda]

The auth header is scoped to https://github.com/ (the trailing / creates a git URL prefix match), so credentials are sent to any URL under github.com for the duration of this command — broader than necessary.

Scope it to just the specific repository:

Suggested change

	fetch origin +refs/pull/${{ github.event.pull_request.number }}/head:refs/remotes/origin/pr-head
	git -c "http.${SERVER_URL}/${GITHUB_REPOSITORY}/.extraheader=${AUTH_HEADER}" \

GITHUB_REPOSITORY = marklogic/copyrighttest, so the key becomes http.https://github.com/marklogic/copyrighttest/.extraheader — credentials only sent to that repo, nothing else on the same host.

[SameeraPriyathamTadikonda]

Additional review concerns (lines outside the diff)

1. TruffleHog Scan action — continue-on-error: true makes it a no-op (line 86)

With continue-on-error: true and no output capture, this git-history scan never blocks the workflow. The actual pass/fail is driven entirely by the Parse scan results docker filesystem scan. Silent gap: a secret added and removed within PR commits is flagged here but doesn't fail the job.

Options:

• Remove continue-on-error: true to let git-history findings block the PR, or
• If current-state-only scanning is intentional, remove this step entirely

---

2. grep -qx "$FILE" — treat as fixed string, not regex (line 143)

File paths like src/main/java/Foo.java contain . which in regex mode matches any character. Use -F for a literal match:

if ! echo "$CHANGED_FILES" | grep -qxF "$FILE"; then

---

3. Post PR comment on findings — no try/catch (line 194)

The github-script block has no try/catch. Any 403/5xx from github.rest.issues.listComments or createComment throws an uncaught exception, fails this step, and stops the job before Fail workflow if verified secrets found runs. A PR with verified secrets could appear to pass.

This matters especially when triggered as an org required workflow (ruleset) — the GITHUB_TOKEN has read-only effective permissions for the triggering repo, so write operations (createComment, updateComment) will 403. Wrap the comment calls in try/catch so failures degrade gracefully without hiding the scan result.

[SameeraPriyathamTadikonda]

Closing this PR as the issues are addressed in #45