trufflehog.yml

# Full-history verified-secret scan. gitleaks runs diff-scoped in pre-commit
# (see .pre-commit-config.yaml); this is a periodic sweep of the entire commit
# history with a different engine and its own detector set, catching anything
# a diff-scoped scan by construction cannot (a secret introduced and later
# removed in the same PR still shows up in history). Also runs on push and
# pull_request so every change is swept, not just the weekly schedule.
name: trufflehog

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: "0 9 * * 0" # weekly, Sunday, staggered off ci.yml
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: trufflehog-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  scan:
    name: full-history secret scan (verified only)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0 # full clone; this is a whole-history scan, not a diff
          persist-credentials: false
      - name: TruffleHog (verified secrets only)
        uses: trufflesecurity/trufflehog@6f3c981e7b77f235fd2702dd74af25fc4b72bf11 # v3.96.0
        with:
          path: ./
          # The action's baked-in command already passes --fail; repeating it
          # is a CLI error ("flag 'fail' cannot be repeated").
          #
          # Lob is excluded because its detector matches this repo's pytest
          # function names. Lob keys are `test_` or `live_` followed by
          # alphanumerics, which is also the shape of every test in tests/:
          # `test_subclasses_satisfy_domain_and_range` and
          # `test_corrupting_a_registry_uri_is_caught` were both reported as
          # VERIFIED on 2026-08-09, and Lob's verifier confirms them because a
          # malformed key and an unauthorized key are indistinguishable in its
          # response. There is no Lob integration here and no direct-mail
          # dependency in pyproject.toml, so the detector can only ever produce
          # noise in this repo. Scoped to the one detector on purpose: excluding
          # tests/ by path would blind the scan to real secrets in fixtures,
          # which is where they most often hide.
          extra_args: --only-verified --exclude-detectors=Lob