feat: 添加 WgpSec Infra 生态系统部分，增强文档描述和链接 #134
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secret Scanning | |
| on: | |
| push: | |
| branches: [ "master" ] | |
| pull_request: | |
| branches: [ "master" ] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| secret-scan: | |
| name: Scan for Secrets (AK/SK/Passwords) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Source | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # Fetch all history for better scanning | |
| - name: TruffleHog Secret Scanning (Push/Workflow Dispatch) | |
| if: github.event_name != 'pull_request' | |
| uses: trufflesecurity/trufflehog@v3.82.13 | |
| with: | |
| # Scan the entire repository for secrets | |
| path: ./ | |
| # Scan for both verified and unverified secrets | |
| # Focus on detecting: Access Keys, Secret Keys, Passwords, API Tokens | |
| # Note: --fail is added automatically by the action | |
| extra_args: --exclude-paths=.trufflehogignore --json | |
| - name: TruffleHog Secret Scanning (Pull Request) | |
| if: github.event_name == 'pull_request' | |
| uses: trufflesecurity/trufflehog@v3.82.13 | |
| with: | |
| # Scan the entire repository for secrets | |
| path: ./ | |
| base: ${{ github.event.pull_request.base.sha }} | |
| head: ${{ github.event.pull_request.head.sha }} | |
| # Scan for both verified and unverified secrets | |
| # Focus on detecting: Access Keys, Secret Keys, Passwords, API Tokens | |
| # Note: --fail is added automatically by the action | |
| extra_args: --exclude-paths=.trufflehogignore --json |