secret-scan.yml

# SPDX-FileCopyrightText: Copyright (c) NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: secret-scan

on:
  push:
    branches: [main, 'release-**']
  pull_request:
    branches: [main, 'release-**']
  merge_group:
    types: [checks_requested]
  workflow_dispatch:

permissions:
  actions: read
  contents: read
  pull-requests: write

concurrency:
  group: secret-scan-${{ github.ref }}
  cancel-in-progress: true

jobs:
  trufflehog-secret-scan:
    name: Secret Scan with TruffleHog
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Run TruffleHog Scan
        # No repository secrets or custom env vars are required; PR comments are disabled.
        uses: dsx-ai-factory/dsx-github-actions/.github/actions/trufflehog-scan@9a9ce3a7770a8b53d2726afa920be3276bc3ddd7
        with:
          # On merge_group there is no push/PR context for TruffleHog to derive a
          # diff range from, so it errors with "BASE == HEAD" and fails the gate,
          # blocking the merge queue. Pass the merge queue's base..head range
          # explicitly. push and pull_request events keep the empty defaults so
          # the action uses its own event-based range.
          base: ${{ github.event_name == 'merge_group' && github.event.merge_group.base_sha || '' }}
          head: ${{ github.event_name == 'merge_group' && github.event.merge_group.head_sha || '' }}
          extra-args: '--results=verified,unknown'
          post-pr-comment: 'false'
          fail-on-findings: 'true'
          version: '3.95.2'