I want to scan the repo. I am using max-depth flag as well, but that will check the files changed in the current commit. Even If i remove the secret it is still exiting in error as it is detecting secrets.

Thanks for making this github action. This issue is not directly related to this action, but may be relevant for users.

I noticed that the max_depth flag wasn't working when I was attempting to use it and after some investigation I realized that - uses: actions/checkout@v2 only takes the last commit by default.

Per the README on https://github.com/actions/checkout (emphasis mine):

Only a single commit is fetched by default, for the ref/SHA that triggered the workflow. Set fetch-depth: 0 to fetch all history for all branches and tags.

Unless I've misunderstood something, it may be worthwhile to update the README adding

with:
    fetch-depth: 0

is required to make available the entire git commit history. I also recognize that this action is built to be running on a 'clean' repo though, so latest commit should be sufficient (unless multiple commit PRs need to be supported).

I'm not sure if this is the best solution because specifying the fetch depth for actions checkout and then the max_depth on the trufflehog level seem to overlap or can be redundant.

GitHub Actions is unable to scan & fetch secrets [as secret exist] from code as integrated in repo,

https://github.com/mukul-seagate11/cortx-hare/pull/1/checks?check_run_id=2361518131

Is anything missing?

Is it possible to just scan the PR code for secrets (rather than the entire repo code)?

cc @edplato

Hi,

I'm creating an intentionally vulnerable repo/project to use for a workshop, and I'd like to demo trufflehog, using github actions. I run trufflehog locally on the project folder and it lights up like a Christmas tree, it finds all the secrets. However, when I run it with the GitHub Action it says it ran successfully, but there is no output. I'm confused.

I tried adding another fake private key, checking it in, which triggers my DotNetDemo.yml actions, and it still has no input. I know truffle hog would find this as it finds this, and more, locally.

Here's my workflow file: https://github.com/shehackspurple/dotnetcore-webapp/blob/master/.github/workflows/DotNetDemo.yml

Thanks for making this action, looking forward to automating this.

Tanya

Hi, how can I exclude some paths or a particular detector type from scanning since it could be a known secret?
Below is my action that I am using -

- name: checkout-pr
      if: ${{ github.event_name == 'pull_request' }}
      uses: actions/checkout@v2
      with:
        fetch-depth: 0
        ref: ${{ github.head_ref }}
    - name: get-branch
      run: |
        echo "BRANCH=$(git branch --show-current)" >> $GITHUB_ENV   
    - name: Run secret scanner
      uses: edplato/[email protected]
      with:
          scanArguments: "--regex --only-verified --entropy=False --max_depth=100 --branch ${{ env.BRANCH }} --rules .github/secrets-scanner/regexes.json"

Hi, I found that the same workflow code

steps:
      - name: Checkout
        uses: actions/checkout@v2
        with:
          submodules: false
          fetch-depth: "0"
      - name: Trufflehog Actions Scan
        uses: edplato/[email protected]
        with:
          scanArguments: "--max_dept 50 -x .github/workflows/exclude-patterns.txt"

works fine when job is triggered by push to the branch

name: detect-secrets
on:
  push:
    branches:
      - "**"

but it doesn't detect any secrets when it is triggered by opening a PR - action is started but and always passes

name: detect-secrets
on:
  pull_request:
    branches: 
      - "**"

the same commit gives different results for push and pull_request. Any idea?

Hi Ed, sorry to bother you again, but since you have checked in your changes, it can't find my keys again. It finds nothing.

I ran trufflehog from my desktop on my repo and it found lots of stuff, with no special arguments: trufflehog https://github.com/shehackspurple/dotnetcore-webapp

I made a video of the whole thing, so you can see my troubleshooting:
https://www.twitch.tv/videos/565679444

I'm confused as to why it worked when it was in a branch, you merged it to master, then it's not working again. Did anything else change besides that and the update to the readme?

gitpython-developers/GitPython#984

rebuilt from not pinned version now causes failing action:
https://github.com/crim-ca/weaver/pull/80/checks?check_run_id=451203427

When I try to use this action, it completes without error but does not find any secrets (regex or high entropy).

I have:

• Ensured I'm using checkout@v2 with fetch-depth: "0" before the trufflehog step.
• Confirmed with a ls -laR that the git repo is indeed checked out in the PWD.
• Explicitly specifying --rules, --entropy --max_depth.
• Running trufflehog locally in the same git repo and it works as expected (detects secrets).

Configuration:

  TruffleHog:
    runs-on: [self-hosted]
    steps:
    - uses: actions/checkout@v2
      with:
        fetch-depth: "0"
    - run: ls -laR
    - uses: edplato/trufflehog-actions-scan@master
      with:
        scanArguments: "--regex --entropy=true --max_depth=1000 --rules regexes.json"

Output from Action with a repo that contains some fake secrets:

Note that it doesn't look like the action is even running trufflehog

Example output from running Trufflehog locally with the same repo:

trufflehog --regex --entropy=false --max_depth=1000 --rules regexes.json file://$(pwd)

-----BEGIN EC PRIVATE KEY-----
~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~
Reason: PGP private key block
Date: 2021-12-09 10:43:49
Hash: 87b860ae90f535ebc11646e9753be23894844966
Filepath: .gitleaks.toml
Branch: origin/secrets_scanning
Commit: add mvp of trufflehog secrets scanning

-----BEGIN PGP PRIVATE KEY BLOCK-----
~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~
Reason: Generic Secret
Date: 2021-12-09 10:43:49
Hash: 87b860ae90f535ebc11646e9753be23894844966
Filepath: fakesecretitems/testbadcode.py
Branch: origin/secrets_scanning
Commit: add mvp of trufflehog secrets scanning

secret : "lolasifidsaveapasswordinplaintextbro"