Skip to content

ci: migrates secret scanning from trufflehog to betterleaks - #78

Merged
wgordon17 merged 2 commits into
mainfrom
chore/migrate-trufflehog-to-betterleaks
Nov 9, 2026
Merged

wgordon17 merged 2 commits into
mainfrom
chore/migrate-trufflehog-to-betterleaks

Conversation

@wgordon17

@wgordon17 wgordon17 commented Nov 4, 2026 •

Copy link
Copy Markdown
Member

Summary

  • Replaces the trufflehog prek hook with betterleaks v1.9.0 — faster, MIT-licensed, medium-confidence gate with redacted output
  • Runs betterleaks in the lint job's single prek invocation (prek runs hooks in parallel) instead of a dedicated scan-job step; the scan job keeps CodeQL only
  • Verified-history scanning moves to the central khepri-deps/secret-scanning scanner, so no TruffleHog workflow is added here

@wgordon17
wgordon17 marked this pull request as ready for review November 4, 2026 18:41
@wgordon17
wgordon17 requested a review from a team November 4, 2026 18:41
@wgordon17
wgordon17 force-pushed the chore/migrate-trufflehog-to-betterleaks branch 2 times, most recently from b8a8ab1 to d6b1673 Compare November 4, 2026 19:20
prek executes hooks in parallel, so the dedicated scan-job step
duplicates work the lint job's single prek run already does.
@wgordon17
wgordon17 merged commit 2968170 into main Nov 9, 2026
25 of 49 checks passed
@wgordon17
wgordon17 deleted the chore/migrate-trufflehog-to-betterleaks branch November 9, 2026 02:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant