Removing hardcoded options in GHA docker run and providing output configuration #4068
Conversation
|
|
|
Hi @kellydunn Thanks for submitting the PR. Can you please sign the CLA. |
action.yml
Outdated
| ghcr.io/trufflesecurity/trufflehog:${VERSION} \ | ||
| git file:///tmp/ \ | ||
| --since-commit \ | ||
| ${BASE:-''} \ | ||
| --branch \ | ||
| ${HEAD:-''} \ | ||
| --fail \ |
There was a problem hiding this comment.
Hey @kellydunn, thanks for this! This definitely looks like a really useful feature for workflows integrating this action.
One question, particularly about the removal of the --fail argument. Does this change alter the expected behavior of the workflow, i.e. fail and exit with a 183 code if a secret is detected (ref)? If so, this may impact any setups that rely on this failure behavior as a guardrail.
Would it make sense to make this behavior configurable, i.e. fail by default, unless explicitly disabled?
There was a problem hiding this comment.
Hello! And fair question! I could see how this might impact workflows that rely on default fail behavior; explicitly opt-ing out of --fail seems reasonable. I'll take a swing at providing a GHA input control similar to base and head parameters in the workflow.
There was a problem hiding this comment.
@nabeelalam, just pushed up 6d2c6cc. We've tested this with our setup, and we can confirm that by default this will preserve the behavior of exiting with 183 unless a user explicitly provides a no_fail value in their workflow action. Lmk what you think.
There was a problem hiding this comment.
@nabeelalam Checking in here, anything else you'd like to see? Mind giving the updates a review?
kellydunn
force-pushed
the
gha-fix
branch
2 times, most recently
from
e194d8f to
c00a72c
Compare
…figuration outputting results outputting results outputting results outputting results outputting results outputting results outputting results Attempting to mount github workspace for commit scans Adding back in hardcoded options, but electing to use GHA vars Adding in explicit no_fail input and check Removing conditional break
Description:
When using the
trufflesecurity/trufflehogGithub Action, there's currently no way to configure--fail, in the Github action itself, as it is hardcoded inaction.ymlhere.Additionally, it's helpful to be able to take the very useful output of trufflehog and process it in our own actions so we can aggregate the data to our observability tools. To enable this, this PR also provides an
outputblock that enables developers to reference Trufflehog output in their actions via${{ steps.trufflehog.outputs.results }}This way, developers can run the github action like so:
Update: This PR now also includes a more explicit mounting of
${{ github.workspace }}to the docker container, as before the relative path being mounted to/tmpwouldn't pick up any changes when providing commit ranges to the scan.Checklist:
make test-community)?make lintthis requires golangci-lint)?