00-scan-secrets.yml

name: Leaked Secrets Scan

on:
  workflow_call:

jobs:
  TruffleHog:
    runs-on: ubuntu-latest
    steps:
      - name: ⬇ Checkout repo
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: ↔ Extract branch name
        shell: bash
        run: echo "##[set-output name=branch;]$(echo ${GITHUB_REF#refs/heads/})"
        id: extract_branch

      - name: 🐷 TruffleHog OSS
        uses: trufflesecurity/trufflehog@v3
        with:
          path: ./
          base: ${{ steps.extract_branch.outputs.branch }}
          head: HEAD

      - name: 💀 Killing me softly
        uses: ./.github/actions/cancel-workflow
        if: failure()
        with:
          token: ${{ secrets.GITHUB_TOKEN }}