Add reusable secretScan workflow for TruffleHog secret scanning

[fukawi2]

Details

Reusable workflow that scans a repository for committed credentials with TruffleHog. Each repo adds a short caller on push.

Scan on push, not pull_request. PR commits are pushed first, so push covers the same ground plus branches that never open a PR. Web-PDFs branch jasper-dontThrowIfPagesDontMatch has carried a GitHub App private key since March 2025 — no PR-based check would see it. Rulesets cannot trigger on push, hence a per-repo caller. Add pull_request only where external forks contribute, such as App.

A finding never fails the check. A pushed credential is already compromised, so blocking a merge does not undo the leak. fail_on_findings exists but defaults to false.

Three non-obvious details, each confirmed:

1. The ghcr image tag has no leading v — 3.97.4 is 200, v3.97.4 is 404. Pinned by digest.
2. --results is omitted deliberately. With --no-verification every finding is unverified, so TruffleHog's own recommended --results=verified,unknown would report nothing — a silently green check.
3. The container runs directly rather than via trufflesecurity/trufflehog. That action hardcodes --fail and exposes no exit code, and --no-fail is rejected with flag 'fail' cannot be repeated. Exit 183 means a finding, anything else means a broken scan, and only reading the code separates them.

Related Issues

https://github.com/Expensify/Expensify/issues/681714

Manual Tests

secretScanSelf.yml makes this repo scan itself via a local ref, so a PR changing secretScan.yml is checked by the version it proposes. That caught two bugs here before review.

I extracted the scan step and ran it against a stubbed docker in a throwaway repo containing a genuinely unreachable commit and a tag-only orphan commit.

Case	Result
Normal push	Scans before..after
Force push / new branch	Falls back to the branch point
Force push to default branch	Capped at --max-depth 50
Branch deleted	Skipped
Tag on a commit already on a branch	Skipped
Tag on a commit reaching no branch	Scanned
Findings, warn-only / enforcing	Warns / fails
Broken scan (exit 1)	Fails, even warn-only
Base SHA missing from clone	Fails, names the commit
pull_request_target, release	Fails, unsupported event

Verify after merge: push a branch to Salt without opening a PR, and confirm the check runs.

Linked PRs

Enable TruffleHog secret scanning in CI — on HOLD until this merges

[fukawi2]

@roryabraham and @neil-marcellini Requesting your reviews as the top contributors to this repo please 🙏

[roryabraham]

Do we plan to keep the schedule / workflow_dispatch triggers?

Is that redundant given that it will run on push to any branch?

[fukawi2]

workflow_dispatch isn't redundant — push only covers commits that land after the workflow exists, so it never scans the history that predates installation. That's the one-off baseline scan. schedule shares the same code branch at zero cost and no caller sets one, so I've left it handled rather than rejected.

[roryabraham]

fetch-depth: 0 is very slow (~4 mins in app).

We might be able to do something like this to optimize fetching, assuming we only need to handle pull_request and push:

- name: Checkout
  uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
  with:
    fetch-depth: 1

- name: Fetch history needed by the scan
  env:
    EVENT_NAME: ${{ github.event_name }}
    PR_NUMBER: ${{ github.event.pull_request.number }}
    PUSH_BEFORE_SHA: ${{ github.event.before }}
    PUSH_AFTER_SHA: ${{ github.event.after }}
    PUSH_REF: ${{ github.event.ref }}
    DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
  shell: bash
  run: |
    set -euo pipefail

    if [[ "$EVENT_NAME" == "pull_request" ]]; then
      # The checkout is shallow at the PR merge commit. Deepen only that ref;
      # the scan needs the PR base/head ancestry, not unrelated branch histories.
      git fetch --no-tags --unshallow origin \
        "+refs/pull/${PR_NUMBER}/merge:refs/remotes/origin/pr-merge"
      exit 0
    fi

    [[ "$EVENT_NAME" == "push" ]] || exit 0

    # A deleted ref introduces no commits.
    if [[ "$PUSH_AFTER_SHA" =~ ^0+$ ]]; then
      exit 0
    fi

    if [[ "$PUSH_REF" == refs/tags/* ]]; then
      # The existing tag logic checks whether any remote branch contains the
      # tagged commit, so retain a full fetch for tag pushes.
      git fetch --no-tags --unshallow origin \
        "+refs/heads/*:refs/remotes/origin/*" \
        "+refs/tags/*:refs/tags/*"
      exit 0
    fi

    # For a normal branch push, deepen by the number of commits in the event.
    # Starting from the checked-out after SHA, this should make before available.
    PUSH_COMMIT_COUNT="$(jq '(.commits // []) | length' "$GITHUB_EVENT_PATH")"
    if ((PUSH_COMMIT_COUNT > 0)); then
      git fetch --no-tags --deepen="$PUSH_COMMIT_COUNT" origin "$PUSH_AFTER_SHA"
    fi

    # Branch creation and some force pushes have no usable before commit in the
    # fetched range. Preserve the existing merge-base fallback, but fetch only
    # the pushed branch and default branch for it.
    if [[ "$PUSH_BEFORE_SHA" =~ ^0+$ ]] ||
       ! git cat-file -e "${PUSH_BEFORE_SHA}^{commit}" 2>/dev/null; then
      FETCH_ARGS=(--no-tags)
      if [[ "$(git rev-parse --is-shallow-repository)" == "true" ]]; then
        FETCH_ARGS+=(--unshallow)
      fi

      git fetch "${FETCH_ARGS[@]}" origin \
        "+refs/heads/${DEFAULT_BRANCH}:refs/remotes/origin/${DEFAULT_BRANCH}" \
        "+${PUSH_REF}:refs/remotes/origin/push-target"
    fi

It also might be useful to wrap that up in a composite action : it could come in handy in other repos too

[fukawi2]

Tried it, and it silently breaks the scan — reverted in 5d0f326.

TruffleHog resolves the merge base for --since-commit through go-git, which ignores .git/shallow:

error chunking dir: unable to resolve merge base: object not found
finished scanning {"chunks": 0, "bytes": 0}

Real git merge-base resolves the same clone at any depth, so it's a go-git limitation rather than something depth tuning fixes. Worse, TruffleHog exited 0 on that error, so the check went green having scanned nothing. I've added --fail-on-scan-errors so that class of failure can't pass silently again — good catch by accident.

If you want to pursue the optimisation, the viable route is dropping --since-commit and using --branch <after> --max-depth <push commit count> instead, which needs no merge base. Happy to try that here if you think it's worth the risk.

[roryabraham]

Ok, bummer. Maybe we file an upstream issue in go-git, or subscribe if there's an existing one so we can do this optimization later.

[roryabraham]

NAB: Not sure all these env aliases for GitHub workflow expressions are helpful. They seem to be adding an indirection without a clear purpose or clarity improvement.