From acd04a98335be2f5fdf9db9bc67ee5e35cb9ac95 Mon Sep 17 00:00:00 2001 From: Aaron Bacchi Date: Tue, 25 Aug 2026 09:07:56 -0400 Subject: [PATCH 1/2] [DEVOPS-10128] Replace TruffleHog with Gitleaks for secret scanning Co-authored-by: Cursor --- .github/workflows/secrets_scan.yml | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) diff --git a/.github/workflows/secrets_scan.yml b/.github/workflows/secrets_scan.yml index 353a8a9..37ee7e7 100644 --- a/.github/workflows/secrets_scan.yml +++ b/.github/workflows/secrets_scan.yml @@ -4,14 +4,5 @@ on: pull_request: jobs: - TruffleHog: - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - name: Secret Scanning - uses: trufflesecurity/trufflehog@main - with: - extra_args: --only-verified + gitleaks: + uses: Labelbox/reusable-workflows/.github/workflows/Secret-Scan.yml@main From 73823ae5562bee852da44f847e0bc580c326c5b7 Mon Sep 17 00:00:00 2001 From: Aaron Bacchi Date: Tue, 25 Aug 2026 11:17:18 -0400 Subject: [PATCH 2/2] [DEVOPS-10128] Remove repository secret-scanning workflow Rely on the existing LLM code-scanning controls instead of maintaining a separate TruffleHog or Gitleaks workflow. --- .github/workflows/secrets_scan.yml | 8 -------- 1 file changed, 8 deletions(-) delete mode 100644 .github/workflows/secrets_scan.yml diff --git a/.github/workflows/secrets_scan.yml b/.github/workflows/secrets_scan.yml deleted file mode 100644 index 37ee7e7..0000000 --- a/.github/workflows/secrets_scan.yml +++ /dev/null @@ -1,8 +0,0 @@ -name: Secret_Scan - -on: - pull_request: - -jobs: - gitleaks: - uses: Labelbox/reusable-workflows/.github/workflows/Secret-Scan.yml@main