PDP-684 Add TruffleHog secret scanning workflow for PR validation #16

GAdityaVarma · 2026-01-07T13:33:13Z

Summary

Introduces a centralized TruffleHog secret scanning workflow that automatically scans all pull requests for exposed secrets (API keys, passwords, tokens, etc.) across the organization.

This implementation:

Scans PR commits for leaked secrets (API keys, passwords, tokens, etc.)
Classifies findings as verified (confirmed active) or unverified (potential match)
Posts PR comments with detailed findings when secrets are detected
Sets commit status to pass/fail based on scan results

Features

Scans only modified files in PRs (fast and efficient)
Works with PRs from forks (public and private)
Configurable exclusion patterns using regex
Supports org-level defaults with repo-level overrides
No workflow file needed in individual repos (uses org rulesets)

How It Works

PR is created or updated
Workflow determines PR type (fork vs same-repo)
Fetches PR commits and applies exclusion patterns
Runs TruffleHog scan on the diff between base and head
If secrets found: posts PR comment and fails the check
If no secrets: sets status to success (no comment posted)

Configuration

Set TRUFFLEHOG_EXCLUDES variable at org or repo level for custom exclusions
Default exclusions include: node_modules, vendor, lock files, minified files

Tested here:
https://github.com/marklogic/copyrighttest/pull/79
https://github.com/marklogic/copyrighttest/pull/78
https://github.com/marklogic/copyrighttest/pull/77

Introduces a centralized GitHub Actions workflow for scanning pull requests for secrets using TruffleHog. Includes a detailed README with setup instructions, exclusion pattern configuration, override options, and troubleshooting guidance.

The workflow now posts PR comments with secret scan findings, sets commit status to pass/fail, and provides clearer merge blocking. Documentation was updated and renamed to trufflehog_readme.md to reflect new features, including secret classification and improved fork PR support.

Copilot

Pull request overview

This PR introduces a centralized TruffleHog secret scanning workflow that automatically validates pull requests across the organization by detecting exposed secrets such as API keys, passwords, and tokens. The workflow runs on all PRs, posts detailed findings as comments when secrets are detected, and sets commit statuses to block merges when necessary.

Key Changes:

Implements GitHub Actions workflow with dual triggers (pull_request and pull_request_target) to handle both same-repo and fork PRs
Configurable exclusion patterns via TRUFFLEHOG_EXCLUDES variable with org-level defaults and repo-level overrides
Automated PR commenting with remediation steps and commit status updates based on scan results

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
`trufflehog_readme.md`	Comprehensive documentation covering setup, configuration, exclusion patterns, workflow triggers, and troubleshooting
`.github/workflows/trufflehog-scan.yml`	GitHub Actions workflow implementing secret scanning with TruffleHog, exclusion handling, result processing, and PR status updates

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

trufflehog_readme.md

Co-authored-by: Copilot <[email protected]>

SameeraPriyathamTadikonda · 2026-01-07T21:06:36Z

.github/workflows/trufflehog-scan.yml

+            echo "${{ vars.TRUFFLEHOG_EXCLUDES }}" | tr ',' '\n' | sed '/^$/d' > .trufflehog-ignore
+          else
+            echo "Using default exclusions from central workflow"
+            cat << 'EOF' > .trufflehog-ignore


Isn't it better to include the defaults always?

Good catch! Updated the logic to make exclusions additive instead of replacement.

SameeraPriyathamTadikonda · 2026-01-07T21:09:45Z

.github/workflows/trufflehog-scan.yml

+            echo "description=No secrets detected in PR changes" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Post PR comment on findings


Do we really need a comment? Can't we just rely on annotations?

Why PR Comments are better for security findings:

Immediate visibility - Developers see the alert without extra navigation

Actionable - The comment includes remediation steps right there

Email notification - PR comment triggers email, ensuring developer sees it

Historical record - Comment stays in PR history for auditing

Team visibility - Reviewers also see the security issue immediately

Mobile-friendly - Easy to check on phone

SameeraPriyathamTadikonda · 2026-01-07T21:12:33Z

.github/workflows/trufflehog-scan.yml

+        uses: actions/github-script@v7
+        with:
+          script: |
+            const commentMarker = '<!-- TRUFFLEHOG-SCAN-COMMENT -->';


If we're planning to add comment then we need to add the following to commit so the user know if the scan ran on the latest changes/commit.

Commit ID/SHA.

Workflow Link/Number to get to the correct logs.

SameeraPriyathamTadikonda · 2026-01-07T21:15:23Z

.github/workflows/trufflehog-scan.yml

+            4. **Push the fix** to this branch
+
+            ### Finding Details
+            Check the [workflow run logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for:


Looks like workflow link is already added, please ignore my previous comment and just add the commit ID to the comment.

github-actions · 2026-01-08T05:15:15Z

🚨 Secret Scanning Alert

TruffleHog detected potential secrets in this pull request.

What to do:

Remove the exposed secret from your code
Rotate the credential immediately - assume it's compromised
Push the fix to this branch
The scan will re-run automatically

Finding Details

Check the workflow run logs for:

File paths containing secrets
Line numbers
Secret types (API key, password, token, etc.)
Verification status (verified = confirmed active)

Workflow Logs

View detailed scan logs

This scan only checks files modified in this PR. Secrets are classified as verified (confirmed active) or unverified (potential match).

Adds a workflow step to update the PR comment when previously detected secrets are resolved, marking the PR as clear. Updates documentation to clarify that exclusion patterns are additive, describes the new comment update behavior, and improves the remediation and PR comment sections for clarity.

GAdityaVarma added 6 commits January 7, 2026 16:13

Update README.md

200cee2

Update trufflehog-scan.yml

bf7b85b

Update trufflehog-scan.yml

527f3f2

Update trufflehog-scan.yml

599658f

GAdityaVarma requested review from SameeraPriyathamTadikonda and Copilot January 7, 2026 13:33

Copilot AI reviewed Jan 7, 2026

View reviewed changes

trufflehog_readme.md Outdated Show resolved Hide resolved

GAdityaVarma requested review from Pragathi-28 and brijeshp56 and removed request for Copilot January 7, 2026 13:33

Update trufflehog_readme.md

e496bac

Co-authored-by: Copilot <[email protected]>

GAdityaVarma requested review from nagalakshmi2024 and rpullepu January 7, 2026 13:34

SameeraPriyathamTadikonda requested changes Jan 7, 2026

View reviewed changes

Update trufflehog-scan.yml

d279b66

GAdityaVarma added 9 commits January 8, 2026 18:05

Update trufflehog-scan.yml

1aae01b

Update trufflehog-scan.yml

77909eb

Update trufflehog-scan.yml

c120b09

Update trufflehog-scan.yml

7ded023

Update trufflehog-scan.yml

40260d7

Update trufflehog-scan.yml

5907188

Update trufflehog-scan.yml

c38506c

Remove workflow_dispatch trigger for ruleset compatibility

6f0f819

GAdityaVarma closed this Jan 9, 2026

GAdityaVarma reopened this Jan 9, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

PDP-684 Add TruffleHog secret scanning workflow for PR validation #16

PDP-684 Add TruffleHog secret scanning workflow for PR validation #16

GAdityaVarma commented Jan 7, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

SameeraPriyathamTadikonda Jan 7, 2026

Uh oh!

GAdityaVarma Jan 8, 2026

Uh oh!

SameeraPriyathamTadikonda Jan 7, 2026

Uh oh!

GAdityaVarma Jan 8, 2026

Uh oh!

SameeraPriyathamTadikonda Jan 7, 2026

Uh oh!

SameeraPriyathamTadikonda Jan 7, 2026

Uh oh!

github-actions bot commented Jan 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

PDP-684 Add TruffleHog secret scanning workflow for PR validation #16

Are you sure you want to change the base?

PDP-684 Add TruffleHog secret scanning workflow for PR validation #16

Conversation

GAdityaVarma commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Features

How It Works

Configuration

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

SameeraPriyathamTadikonda Jan 7, 2026

Choose a reason for hiding this comment

Uh oh!

GAdityaVarma Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

SameeraPriyathamTadikonda Jan 7, 2026

Choose a reason for hiding this comment

Uh oh!

GAdityaVarma Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

SameeraPriyathamTadikonda Jan 7, 2026

Choose a reason for hiding this comment

Uh oh!

SameeraPriyathamTadikonda Jan 7, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jan 8, 2026

🚨 Secret Scanning Alert

What to do:

Finding Details

Workflow Logs

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

GAdityaVarma commented Jan 7, 2026 •

edited

Loading