Fix TruffleHog workflow failing on push events with "BASE and HEAD commits are the same"

[Copilot]

TruffleHog was failing on push events because base: ${{ github.event.repository.default_branch }} and head: HEAD resolve to the same commit when pushing directly to master.

Changes

Split the TruffleHog step into two conditional executions:

• Push/workflow_dispatch: Omit base and head parameters, allowing TruffleHog to scan commits in the push using its default behavior
• Pull requests: Use github.event.pull_request.base.sha and github.event.pull_request.head.sha to explicitly scan the diff

- name: TruffleHog Secret Scanning (Push/Workflow Dispatch)
  if: github.event_name != 'pull_request'
  uses: trufflesecurity/trufflehog@v3.82.13
  with:
    path: ./
    extra_args: --exclude-paths=.trufflehogignore --json

- name: TruffleHog Secret Scanning (Pull Request)
  if: github.event_name == 'pull_request'
  uses: trufflesecurity/trufflehog@v3.82.13
  with:
    path: ./
    base: ${{ github.event.pull_request.base.sha }}
    head: ${{ github.event.pull_request.head.sha }}
    extra_args: --exclude-paths=.trufflehogignore --json

Original prompt

Problem

The secret scanning workflow is failing with the error:

BASE and HEAD commits are the same. TruffleHog won't scan anything.

This occurs when pushing directly to the master branch because both base and head resolve to the same commit.

Solution Required

Fix the .github/workflows/secret-scan.yml workflow file to properly handle different event types:

1. For push events: Remove the base and head parameters to let TruffleHog use its default behavior (scanning the commits in the push)
2. For pull_request events: Use the proper base and head references for PR scanning
3. For workflow_dispatch: Use default scanning behavior

Current Configuration (Lines 23-33 in .github/workflows/secret-scan.yml)

- name: TruffleHog Secret Scanning
  uses: trufflesecurity/trufflehog@v3.82.13
  with:
    path: ./
    base: ${{ github.event.repository.default_branch }}
    head: HEAD
    extra_args: --exclude-paths=.trufflehogignore --json

Recommended Fix

Replace the TruffleHog step with conditional logic:

- name: TruffleHog Secret Scanning (Push/Workflow Dispatch)
  if: github.event_name != 'pull_request'
  uses: trufflesecurity/trufflehog@v3.82.13
  with:
    path: ./
    extra_args: --exclude-paths=.trufflehogignore --json

- name: TruffleHog Secret Scanning (Pull Request)
  if: github.event_name == 'pull_request'
  uses: trufflesecurity/trufflehog@v3.82.13
  with:
    path: ./
    base: ${{ github.event.pull_request.base.sha }}
    head: ${{ github.event.pull_request.head.sha }}
    extra_args: --exclude-paths=.trufflehogignore --json

This approach:

• For push events and manual triggers: Scans using TruffleHog's default behavior
• For pull requests: Explicitly scans the diff between base and head commits
• Prevents the "BASE and HEAD commits are the same" error

Reference

• Failed job: https://github.com/wgpsec/redc-template/actions/runs/21281543311/job/61252486141
• Commit: 05d0179
• TruffleHog documentation: https://github.com/trufflesecurity/trufflehog#octocat-trufflehog-github-action

This pull request was created from Copilot chat.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.