secret-scan.yml

name: secret-scan
on: 
  pull_request:
    branches:
      - main
    paths-ignore:
    - "LICENSE"
    - "CODEOWNERS"

permissions:  # added using https://github.com/step-security/secure-repo
  contents: read
  
jobs:
  secret-scan: # scan for any live secrets in the repository using trufflehog
    runs-on: ubuntu-latest
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
      with:
        egress-policy: audit
    - name: Checkout code
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        fetch-depth: 0
    - name: Default Secret Scanning
      uses: trufflesecurity/trufflehog@e4956615ad9a60a19b3bdb8fd40d91f65222f5ff # main
      with:
        extra_args: --debug --no-verification # Warn on potential violations