Skip to content

Commit 882f1aa

Browse files
Update README.md
I have read the CLA Document and I hereby sign the CLA
1 parent a0b06d8 commit 882f1aa

File tree

1 file changed

+9
-3
lines changed

1 file changed

+9
-3
lines changed

examples/trufflehog/README.md

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
# **Trufflehog Secret Scan Evidence Example**
22

3-
This repository provides a working example of a GitHub Actions workflow that automates secret scanning using **Trufflehog**. It then attaches the resulting secret detection report as signed, verifiable evidence to the package in **JFrog Artifactory**.
3+
This repository provides a working example of a GitHub Actions workflow that automatically scans a repository for exposed secrets using Trufflehog. It then attaches the resulting scan report as signed, verifiable evidence to a Docker image in JFrog Artifactory.
44

5-
This workflow is an essential pattern for DevSecOps, creating a traceable, compliant, and secure software supply chain by detecting and documenting potential secrets in your codebase.
5+
This workflow is an essential DevSecOps practice, helping to prevent accidental secret leakage by creating a traceable and auditable record of what was found in your codebase at a specific point in time.
66

77
### **Key Features**
88

@@ -105,18 +105,24 @@ Once the workflow completes successfully, you can navigate to your repository in
105105
### **Key Commands Used**
106106

107107
* **Run Trufflehog Scan:**
108+
This step runs the `trufflesecurity/trufflehog` container to scan the entire checked-out repository. The results are output in a `.jsonl` (JSON Lines) format. The `|| true` ensures the workflow continues even if secrets are found, allowing the findings to be reported as evidence.
108109

109110
```bash
110111
docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest filesystem /pwd --json
111112
```
112113

113114
* **Process Results:**
115+
The raw `.jsonl` output from Trufflehog is processed in two steps:
116+
117+
1. A Python script (`jsonl_to_json_converted.py`) converts the JSON Lines file into a standard, well-formed JSON array named `trufflehog.json`, which is required for the evidence predicate.
118+
2. If `ATTACH_OPTIONAL_CUSTOM_MARKDOWN_TO_EVIDENCE` is `true`, a second script (`process_trufflehog_results.py`) generates a human-readable Markdown summary.
114119

115120
```bash
116121
python process_trufflehog_results.py trufflehog-results.json
117122
```
118123

119124
* **Attach Evidence:**
125+
This final step uses jf evd create to attach the processed trufflehog.json report to the Docker image. This creates a permanent, tamper-proof record of the secret scan for the associated build.
120126

121127
```bash
122128
jf evd create \
@@ -133,4 +139,4 @@ jf evd create \
133139

134140
* [Trufflehog Documentation](https://github.com/trufflesecurity/trufflehog)
135141
* [JFrog Evidence Management](https://jfrog.com/help/r/jfrog-artifactory-documentation/evidence-management)
136-
* [JFrog CLI Documentation](https://jfrog.com/getcli/)
142+
* [JFrog CLI Documentation](https://jfrog.com/getcli/)

0 commit comments

Comments
 (0)