ci: add trufflehog secrets scan by KooshaPari · Pull Request #141 · KooshaPari/HexaKit

KooshaPari · 2026-05-02T11:58:40Z

User description

Adds trufflehog secrets scanning workflow.

Note

Medium Risk
Adds a new PR/push GitHub Actions job that runs third-party trufflehog tooling; main risk is CI supply-chain/availability impact (notably trufflehog/actions/setup@main is unpinned) and potential new noise/failures in PR checks.

Overview
Adds a new GitHub Actions workflow (.github/workflows/trufflehog.yml) that runs TruffleHog secret scanning on pushes to main and on all pull requests.

The job checks out full git history (fetch-depth: 0), installs TruffleHog via trufflehog/actions/setup@main, and runs trufflehog github --only-verified --no-update using GITHUB_TOKEN.

^{Reviewed by Cursor Bugbot for commit bddc5bf. Bugbot is set up for automated code reviews on this repo. Configure here.}

CodeAnt-AI Description

Add secret scanning to pull requests and main branch pushes

What Changed

Runs a secret scan on every pull request and on pushes to main
Checks the full repository history so older exposed secrets can still be found
Fails the check when verified secrets are detected

Impact

✅ Earlier secret leak detection
✅ Fewer exposed credentials in pull requests
✅ Safer main branch changes

🔄 Retrigger CodeAnt AI Review

Details

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

codeant-ai · 2026-05-02T11:58:45Z

CodeAnt AI is reviewing your PR.

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

gemini-code-assist · 2026-05-02T11:58:45Z

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

coderabbitai · 2026-05-02T11:58:47Z

Warning

Rate limit exceeded

@KooshaPari has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 13 minutes and 31 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 5da96375-294a-4e92-919e-95e495bf1e68

📥 Commits

Reviewing files that changed from the base of the PR and between 2fd0df0 and bddc5bf.

📒 Files selected for processing (1)

.github/workflows/trufflehog.yml

Warning

`.coderabbit.yaml` has a parsing error

The CodeRabbit configuration file in this repository has a parsing error and default settings were used instead. Please fix the error(s) in the configuration file. You can initialize chat with CodeRabbit to get help with the configuration file.

💥 Parsing errors (1)

unknown escape sequence in ".coderabbit.yaml" (41:11)

 38 |       - "async_await_patterns"
 39 |     patterns_to_watch:
 40 |       - "^unsafe "
 41 |       - "\.unwrap\(\)"
----------------^
 42 |       - "\.expect\("
 43 |       - "std::panic"

⚙️ Configuration instructions

Please see the configuration documentation for more information.
You can also validate your configuration using the online YAML validator.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/add-trufflehog-20260502

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch feat/add-trufflehog-20260502

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Review rate limit: 0/1 reviews remaining, refill in 13 minutes and 31 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-05-02T11:59:08Z

🔒 Snyk Security Scan Results

Snyk vulnerability scan completed. View results in GitHub Code Scanning dashboard.

github-actions · 2026-05-02T11:59:32Z

🔒 Snyk Security Scan Results

Snyk vulnerability scan completed. View results in GitHub Code Scanning dashboard.

sonarqubecloud · 2026-05-02T11:59:42Z

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud

codeant-ai · 2026-05-02T12:00:47Z

CodeAnt AI finished reviewing your PR.

cursor

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{Bugbot Autofix is ON, but it could not run because on-demand usage is turned off. To enable Bugbot Autofix, turn on on-demand usage and set a spend limit in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit bddc5bf. Configure here.}

cursor · 2026-05-02T12:01:15Z

+        with:
+          fetch-depth: 0
+      - uses: trufflehog/actions/setup@main
+      - run: trufflehog github --only-verified --no-update


Missing required --repo or --org flag

High Severity

The trufflehog github subcommand requires either a --repo or --org flag to specify what to scan. Running trufflehog github --only-verified --no-update without either flag will fail because the tool doesn't know which repository or organization to scan. A --repo flag pointing to the current repository (e.g., via ${{ github.repository }}) is needed for this workflow to function.

^{Reviewed by Cursor Bugbot for commit bddc5bf. Configure here.}

cursor · 2026-05-02T12:01:15Z

+      - uses: trufflehog/actions/setup@main
+      - run: trufflehog github --only-verified --no-update
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}


Wrong environment variable name for TruffleHog token

Medium Severity

TruffleHog reads the GitHub token from the GITHUB_TOKEN environment variable, but this workflow exposes it as GH_TOKEN instead. The GH_TOKEN convention is used by the GitHub CLI (gh), not TruffleHog. This means TruffleHog won't authenticate and will be unable to scan private repository content or may hit API rate limits.

^{Reviewed by Cursor Bugbot for commit bddc5bf. Configure here.}

cursor · 2026-05-02T12:01:15Z

+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          fetch-depth: 0
+      - uses: trufflehog/actions/setup@main


Security action pinned to mutable @main branch reference

Medium Severity

The trufflehog/actions/setup action is pinned to @main, a mutable branch reference, while the actions/checkout step is correctly pinned to a commit SHA. This inconsistency creates a supply chain attack vector — if the upstream action is compromised, the workflow (which receives secrets.GITHUB_TOKEN) could be exploited. A security-scanning workflow is an especially high-value target for this type of attack.

^{Reviewed by Cursor Bugbot for commit bddc5bf. Configure here.}

codeant-ai · 2026-05-10T00:52:19Z

CodeAnt AI is running the review.

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

codeant-ai · 2026-05-10T00:54:28Z

Sequence Diagram

This PR adds a GitHub Actions workflow that runs a Trufflehog secrets scan on every pull request and on pushes to the main branch, failing the check if verified secrets are detected.

sequenceDiagram
    participant Developer
    participant GitHub
    participant CI
    participant Trufflehog

    Developer->>GitHub: Push to main or open pull request
    GitHub->>CI: Trigger Trufflehog workflow
    CI->>GitHub: Checkout repository with full history
    CI->>Trufflehog: Setup and run GitHub scan with token
    Trufflehog-->>CI: Return verified secrets findings
    CI-->>GitHub: Mark secrets scan check as pass or fail

Generated by CodeAnt AI

codeant-ai · 2026-05-10T00:56:17Z

CodeAnt AI finished running the review.

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

codeant-ai · 2026-05-10T01:31:10Z

CodeAnt AI is running the review.

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

codeant-ai · 2026-05-10T01:32:31Z

Sequence Diagram

This PR adds a GitHub Actions workflow that runs a Trufflehog secret scan on every pull request and on pushes to the main branch, failing the check when verified secrets are detected.

sequenceDiagram
    participant Developer
    participant GitHubActions
    participant TrufflehogScanner

    Developer->>GitHubActions: Push to main or open pull request
    GitHubActions->>GitHubActions: Start Trufflehog secrets scan job
    GitHubActions->>TrufflehogScanner: Run github scan with only verified findings
    TrufflehogScanner-->>GitHubActions: Return scan results

    alt Verified secrets found
        GitHubActions-->>Developer: Secret scan check fails
    else No verified secrets
        GitHubActions-->>Developer: Secret scan check passes
    end

Generated by CodeAnt AI

codeant-ai · 2026-05-10T01:35:13Z

CodeAnt AI finished running the review.

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

codeant-ai · 2026-05-11T01:09:37Z

CodeAnt AI is running the review.

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

codeant-ai · 2026-05-11T01:10:54Z

Sequence Diagram

This PR adds a GitHub Actions workflow that runs Trufflehog secret scanning on pushes to main and on all pull requests, failing the check when verified secrets are detected.

sequenceDiagram
    participant Developer
    participant GitHub
    participant CI Workflow
    participant Trufflehog

    Developer->>GitHub: Push to main or open pull request
    GitHub->>CI Workflow: Trigger Trufflehog secrets scan job
    CI Workflow->>GitHub: Checkout full repository history
    CI Workflow->>Trufflehog: Setup Trufflehog action
    CI Workflow->>GitHub: Run secrets scan with repository token
    Trufflehog-->>CI Workflow: Return verified secrets findings
    CI Workflow-->>GitHub: Mark check as pass or fail

Generated by CodeAnt AI

codeant-ai · 2026-05-11T01:12:34Z

CodeAnt AI finished running the review.

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

codeant-ai · 2026-05-11T01:17:00Z

CodeAnt AI is running the review.

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

codeant-ai · 2026-05-11T01:18:28Z

Sequence Diagram

This PR adds a GitHub Actions workflow that runs a Trufflehog secret scan on every push to main and on all pull requests, failing the check when verified secrets are found.

sequenceDiagram
    participant Developer
    participant GitHub
    participant TrufflehogJob

    Developer->>GitHub: Push to main or open pull request
    GitHub->>TrufflehogJob: Trigger Trufflehog workflow
    TrufflehogJob->>GitHub: Checkout full repository history
    TrufflehogJob->>TrufflehogJob: Setup Trufflehog tool
    TrufflehogJob->>GitHub: Run Trufflehog github scan with token
    GitHub-->>TrufflehogJob: Secret scan results

    alt Verified secrets found
        TrufflehogJob-->>GitHub: Mark check as failed
    else No verified secrets
        TrufflehogJob-->>GitHub: Mark check as passed
    end

Generated by CodeAnt AI

codeant-ai · 2026-05-11T01:20:06Z

CodeAnt AI finished running the review.

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

ci: add trufflehog secrets scan

bddc5bf

Copilot AI review requested due to automatic review settings May 2, 2026 11:58

codeant-ai Bot added the size:S This PR changes 10-29 lines, ignoring generated files label May 2, 2026

cursor Bot reviewed May 2, 2026

View reviewed changes

Copilot started reviewing on behalf of KooshaPari May 2, 2026 12:01 View session

KooshaPari merged commit 276a13f into main May 2, 2026
40 of 65 checks passed

KooshaPari deleted the feat/add-trufflehog-20260502 branch May 2, 2026 12:05

KooshaPari review requested due to automatic review settings May 2, 2026 12:21

codeant-ai Bot added size:S This PR changes 10-29 lines, ignoring generated files and removed size:S This PR changes 10-29 lines, ignoring generated files labels May 10, 2026

codeant-ai Bot added size:S This PR changes 10-29 lines, ignoring generated files and removed size:S This PR changes 10-29 lines, ignoring generated files labels May 11, 2026

Conversation

KooshaPari commented May 2, 2026 • edited by codeant-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

CodeAnt-AI Description

What Changed

Impact

Checking Your Pull Request

Talking to CodeAnt AI

Example

Preserve Org Learnings with CodeAnt

Example

Retrigger review

Check Your Repository Health

Uh oh!

codeant-ai Bot commented May 2, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

gemini-code-assist Bot commented May 2, 2026

Uh oh!

coderabbitai Bot commented May 2, 2026

Rate limit exceeded

.coderabbit.yaml has a parsing error

Uh oh!

github-actions Bot commented May 2, 2026

🔒 Snyk Security Scan Results

Uh oh!

github-actions Bot commented May 2, 2026

🔒 Snyk Security Scan Results

Uh oh!

sonarqubecloud Bot commented May 2, 2026

Quality Gate failed

Uh oh!

codeant-ai Bot commented May 2, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot May 2, 2026

Choose a reason for hiding this comment

Missing required --repo or --org flag

Uh oh!

cursor Bot May 2, 2026

Choose a reason for hiding this comment

Wrong environment variable name for TruffleHog token

Uh oh!

cursor Bot May 2, 2026

Choose a reason for hiding this comment

Security action pinned to mutable @main branch reference

Uh oh!

Uh oh!

codeant-ai Bot commented May 10, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

codeant-ai Bot commented May 10, 2026

Sequence Diagram

Uh oh!

codeant-ai Bot commented May 10, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

codeant-ai Bot commented May 10, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

codeant-ai Bot commented May 10, 2026

Sequence Diagram

Uh oh!

codeant-ai Bot commented May 10, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

codeant-ai Bot commented May 11, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

codeant-ai Bot commented May 11, 2026

Sequence Diagram

Uh oh!

codeant-ai Bot commented May 11, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

codeant-ai Bot commented May 11, 2026

Thanks for using CodeAnt! 🎉

KooshaPari commented May 2, 2026 •

edited by codeant-ai Bot

Loading

`.coderabbit.yaml` has a parsing error

Missing required `--repo` or `--org` flag

Security action pinned to mutable `@main` branch reference