From 8a28c4b016b100eb9cf7c024ec99771662fd7122 Mon Sep 17 00:00:00 2001 From: James Newman Date: Thu, 30 Jul 2026 09:59:28 -0400 Subject: [PATCH 1/2] ci: remove hardcoded secrets check from PR workflow Trunk already runs trufflehog at the PR level (trufflehog@3.90.6 in .trunk/trunk.yaml), alongside a custom mparticle-api-key-check rule, so this job was duplicating secret scanning that Trunk Check already covers. The job was also intermittently red -- 3 failures in 70 recent runs, always in ~5s. It failed on #742 while passing on #743 and #744 with identical config. The cause is in the reusable workflow, which resolves and downloads "latest" trufflehog at runtime by curling the GitHub releases API and grepping the response; that step breaks when the API rate-limits. Trunk pins its trufflehog version and has no runtime download, so it does not share this failure mode. Nothing in the workflow depends on the removed job; no other job referenced it via needs. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/pull-request.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index 95135f56a..c6b704f8c 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -24,9 +24,6 @@ jobs: uses: trunk-io/trunk-action@04ba50e7658c81db7356da96657e6e77f220bfa3 # v1.3.1 with: check-mode: pull_request - pr-check-hadcoded-secrets: - name: "Check PR for hardcoded secrets" - uses: mParticle/mparticle-workflows/.github/workflows/security-hardcoded-secrets.yml@main instrumented-core: uses: ./.github/workflows/instrumented-tests.yml From 361da68baeb00f25dae27a7d1e23b5e98fcbbe60 Mon Sep 17 00:00:00 2001 From: James Newman Date: Thu, 30 Jul 2026 10:07:22 -0400 Subject: [PATCH 2/2] ci: enable trufflehog-git to scan the commits a PR adds The already-enabled trufflehog linter runs `trufflehog filesystem` against changed files in the working tree, so it cannot see a secret that was committed and then removed in a later commit on the same branch -- the file no longer exists to scan. trufflehog-git closes that gap. It runs `trufflehog git --since-commit ${upstream-ref}`, walking only the commits the PR adds, so it stays fast (~1.7s) and does not resurface historical findings. Demonstrated with a private key committed then removed on a branch: filesystem scan -> missed it (only the pre-existing daily.yml FP) git-history scan -> PrivateKey <- probe-key.pem @ f48c6617 Both linters keep Trunk's default --only-verified, so this widens scan scope, not the reporting threshold. Co-Authored-By: Claude Opus 5 (1M context) --- .trunk/trunk.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml index 012775cc9..4e1b1783e 100644 --- a/.trunk/trunk.yaml +++ b/.trunk/trunk.yaml @@ -35,6 +35,10 @@ lint: - shellcheck@0.11.0 - shfmt@3.6.0 - trufflehog@3.90.6 + # Scans the commits a PR adds (--since-commit ${upstream-ref}), which catches + # secrets that were committed and then removed later on the same branch -- + # the working-tree scan above cannot see those. + - trufflehog-git@3.90.6 - mparticle-api-key-check # Custom rule to prevent mParticle API keys from being committed definitions: - name: mparticle-api-key-check