Update msdo-trufflehog.yml

Updated yml to a working one I build in az-104 training repo

Author: theangrytech-git

.github/workflows/msdo-trufflehog.yml

@@ -24,13 +24,41 @@ jobs:
           git clone https://github.com/${{ github.repository }} .
           git checkout ${{ github.ref_name }}
 
-      - name: Install TruffleHog
+      - name: Install jq (if needed)
+        run: sudo apt-get install -y jq
+
+      - name: Install TruffleHog (v3+ CLI)
         run: |
-          pip install trufflehog
+          echo "Fetching latest TruffleHog release asset for Linux..."
+
+          ASSET_URL=$(curl -s https://api.github.com/repos/trufflesecurity/trufflehog/releases/latest \
+            | jq -r '.assets[] | select(.name | test("linux_amd64.tar.gz$")) | .browser_download_url')
+
+          if [ -z "$ASSET_URL" ]; then
+            echo "Could not find Linux binary asset for TruffleHog. Exiting."
+            exit 1
+          fi
+
+          echo "Downloading from $ASSET_URL"
+          curl -sSL -o trufflehog.tar.gz "$ASSET_URL"
+          tar -xzf trufflehog.tar.gz
+          chmod +x trufflehog
+          file trufflehog
+          sudo mv trufflehog /usr/local/bin/
+          trufflehog --version
+
+      - name: Show files to be scanned
+        run: |
+          echo "Files that will be scanned:"
+          find . -type f \( -name "*.tf" -o -name "*.tfvars" -o -name "*.js" -o -name "*.jsx" -o -name "*.ts" -o -name "*.tsx" -o -name "*.py" -o -name "*.json" -o -name "*.yml" -o -name "*.yaml" -o -name "*.bicep" -o -name "*.cs" -o -name "*.csproj" \)
 
       - name: Run TruffleHog and generate JSON report
         run: |
-          trufflehog filesystem --directory . --json > trufflehog-findings.json || true
+          echo "\.terraform\.lock\.hcl$" > exclude-paths.txt
+          trufflehog filesystem . \
+            --json \
+            -x exclude-paths.txt \
+            > trufflehog-findings.json || true
 
       - name: Convert TruffleHog findings to SARIF format
         if: github.repository_visibility == 'public'
@@ -39,7 +67,7 @@ jobs:
           echo "" >> convert_to_sarif.py
           echo "try:" >> convert_to_sarif.py
           echo "  with open('trufflehog-findings.json') as f:" >> convert_to_sarif.py
-          echo "    findings = json.load(f)" >> convert_to_sarif.py
+          echo "    findings = [json.loads(line) for line in f if line.strip()]" >> convert_to_sarif.py
           echo "except Exception as e:" >> convert_to_sarif.py
           echo "  print('Failed to parse findings:', e)" >> convert_to_sarif.py
           echo "  findings = []" >> convert_to_sarif.py
@@ -62,7 +90,10 @@ jobs:
           echo "" >> convert_to_sarif.py
           echo "for finding in findings:" >> convert_to_sarif.py
           echo "  reason = finding.get('reason', 'Secret detected')" >> convert_to_sarif.py
-          echo "  rule_id = f\"trufflehog-{reason.replace(' ', '-')[:64]}\"" >> convert_to_sarif.py
+          echo "  path = finding.get('path', '')" >> convert_to_sarif.py
+          echo "  line = finding.get('line', 1)" >> convert_to_sarif.py
+          echo "  strings_found = ', '.join(finding.get('stringsFound', []))" >> convert_to_sarif.py
+          echo "  rule_id = f'trufflehog-{reason.replace(\" \", \"-\")[:64]}'" >> convert_to_sarif.py
           echo "  if rule_id not in seen_rules:" >> convert_to_sarif.py
           echo "    sarif['runs'][0]['tool']['driver']['rules'].append({" >> convert_to_sarif.py
           echo "      'id': rule_id," >> convert_to_sarif.py
@@ -72,11 +103,13 @@ jobs:
           echo "  sarif['runs'][0]['results'].append({" >> convert_to_sarif.py
           echo "    'ruleId': rule_id," >> convert_to_sarif.py
           echo "    'level': 'warning'," >> convert_to_sarif.py
-          echo "    'message': {'text': reason}," >> convert_to_sarif.py
+          echo "    'message': {" >> convert_to_sarif.py
+          echo "      'text': f'{reason} in {path} at line {line}: {strings_found}'" >> convert_to_sarif.py
+          echo "    }," >> convert_to_sarif.py
           echo "    'locations': [{" >> convert_to_sarif.py
           echo "      'physicalLocation': {" >> convert_to_sarif.py
-          echo "        'artifactLocation': {'uri': finding.get('path', '')}," >> convert_to_sarif.py
-          echo "        'region': {'startLine': 1}" >> convert_to_sarif.py
+          echo "        'artifactLocation': { 'uri': path }," >> convert_to_sarif.py
+          echo "        'region': { 'startLine': line }" >> convert_to_sarif.py
           echo "      }" >> convert_to_sarif.py
           echo "    }]" >> convert_to_sarif.py
           echo "  })" >> convert_to_sarif.py