Merge pull request #16 from wgpsec/copilot/fix-secret-scan-workflow

Fix TruffleHog workflow failing on push events with "BASE and HEAD commits are the same"

Author: No-Github

.github/workflows/secret-scan.yml

@@ -20,13 +20,25 @@ jobs:
         with:
           fetch-depth: 0  # Fetch all history for better scanning
 
-      - name: TruffleHog Secret Scanning
+      - name: TruffleHog Secret Scanning (Push/Workflow Dispatch)
+        if: github.event_name != 'pull_request'
         uses: trufflesecurity/trufflehog@v3.82.13
         with:
           # Scan the entire repository for secrets
           path: ./
-          base: ${{ github.event.repository.default_branch }}
-          head: HEAD
+          # Scan for both verified and unverified secrets
+          # Focus on detecting: Access Keys, Secret Keys, Passwords, API Tokens
+          # Note: --fail is added automatically by the action
+          extra_args: --exclude-paths=.trufflehogignore --json
+
+      - name: TruffleHog Secret Scanning (Pull Request)
+        if: github.event_name == 'pull_request'
+        uses: trufflesecurity/trufflehog@v3.82.13
+        with:
+          # Scan the entire repository for secrets
+          path: ./
+          base: ${{ github.event.pull_request.base.sha }}
+          head: ${{ github.event.pull_request.head.sha }}
           # Scan for both verified and unverified secrets
           # Focus on detecting: Access Keys, Secret Keys, Passwords, API Tokens
           # Note: --fail is added automatically by the action