PDP-684 Add TruffleHog secret scanning workflow for PR validation

[GAdityaVarma]

Summary

Introduces a centralized TruffleHog secret scanning workflow that automatically scans all pull requests for exposed secrets (API keys, passwords, tokens, etc.) across the organization.

This implementation:

• Scans PR commits for leaked secrets (API keys, passwords, tokens, etc.)
• Classifies findings as verified (confirmed active) or unverified (potential match)
• Posts PR comments with detailed findings when secrets are detected
• Sets commit status to pass/fail based on scan results

Features

• Scans only modified files in PRs (fast and efficient)
• Works with PRs from forks (public and private)
• Configurable exclusion patterns using regex
• Supports org-level defaults with repo-level overrides
• No workflow file needed in individual repos (uses org rulesets)

How It Works

1. PR is created or updated
2. Workflow determines PR type (fork vs same-repo)
3. Fetches PR commits and applies exclusion patterns
4. Runs TruffleHog scan on the diff between base and head
5. If secrets found: posts PR comment and fails the check
6. If no secrets: sets status to success (no comment posted)

Configuration

• Set TRUFFLEHOG_EXCLUDES variable at org or repo level for custom exclusions
• Default exclusions include: node_modules, vendor, lock files, minified files

Tested here:
https://github.com/marklogic/copyrighttest/pull/79
https://github.com/marklogic/copyrighttest/pull/78
https://github.com/marklogic/copyrighttest/pull/77

[Copilot]

Pull request overview

This PR introduces a centralized TruffleHog secret scanning workflow that automatically validates pull requests across the organization by detecting exposed secrets such as API keys, passwords, and tokens. The workflow runs on all PRs, posts detailed findings as comments when secrets are detected, and sets commit statuses to block merges when necessary.

Key Changes:

• Implements GitHub Actions workflow with dual triggers (pull_request and pull_request_target) to handle both same-repo and fork PRs
• Configurable exclusion patterns via TRUFFLEHOG_EXCLUDES variable with org-level defaults and repo-level overrides
• Automated PR commenting with remediation steps and commit status updates based on scan results

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
trufflehog_readme.md	Comprehensive documentation covering setup, configuration, exclusion patterns, workflow triggers, and troubleshooting
.github/workflows/trufflehog-scan.yml	GitHub Actions workflow implementing secret scanning with TruffleHog, exclusion handling, result processing, and PR status updates

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.