secret-scan-scheduled.yml

# SPDX-License-Identifier: Apache-2.0
# Scheduled, full-history, verified-secrets-only scan (SEC-19). This is deliberately separate from
# the per-PR `gitleaks` step in ci.yml: gitleaks runs the incremental diff on every push/PR (fast
# feedback), while this job re-scans the ENTIRE committed history on a schedule with a second tool
# (TruffleHog) that verifies credentials against their issuing service before flagging them — so a
# secret that slipped in before gitleaks' ruleset caught that pattern, or a gitleaks false-negative,
# still gets caught, and a false-positive noise problem doesn't drown out real findings.
#
# Added in the 2026-07-05 remediation pass.
# NOTE: like every workflow here, this only runs once committed and pushed to GitHub.

name: Scheduled secret scan (full history, verified only)

on:
  schedule:
    # Weekly, Monday 05:00 UTC.
    - cron: "0 5 * * 1"
  workflow_dispatch: {}

permissions:
  contents: read

concurrency:
  group: secret-scan-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  trufflehog:
    name: TruffleHog (full-history, verified-only, blocking)
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Checkout (full history)
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      # On a `schedule` trigger the action scans the full history of the checked-out ref (no
      # base/head diff), per its own event-type handling. `--results=verified` narrows the
      # blocking condition to secrets TruffleHog could confirm are live against the issuing
      # service — the "failing on verified hits" bar from SEC-19 — rather than every unverified
      # pattern match, which would be noisy on a codebase gitleaks (pattern-based) already covers
      # per-PR.
      - name: TruffleHog OSS — full history, verified secrets only
        uses: trufflesecurity/trufflehog@6f3c981e7b77f235fd2702dd74af25fc4b72bf11  # v3.96.0
        with:
          path: ./
          # Pinned. The action's `version` input defaults to "latest" and it runs
          # `ghcr.io/trufflesecurity/trufflehog:${VERSION}`, so SHA-pinning the action
          # above does not pin what actually scans. That is how this gate changed
          # behaviour with no commit here: upstream published 3.96.0 and the next
          # run picked it up.
          version: "3.96.0"
          # Lob is excluded because 3.96.0's Lob detector pattern,
          # `\b((live|test)_[a-zA-Z0-9_]{35})\b`, matches any identifier starting
          # `test_` with exactly 35 word characters after it, which is an ordinary
          # pytest function name. Its verifier then POSTs to api.lob.com and reads the
          # 403 as proof of a live key with no billing attached, so matches are
          # promoted to verified. There is no Lob integration in this repo. Scoped to
          # the one detector rather than excluding tests/ by path, because fixtures are
          # where a real credential is most likely to land by accident. Same reasoning
          # as gtfs-scorecard ADR 0044.
          extra_args: --results=verified --exclude-detectors=Lob