Add advisory TruffleHog org scan workflow (github source)

Made-with: Cursor

Author: isaiah-grafana

.github/workflows/org-trufflehog-fullscan.yml

@@ -0,0 +1,123 @@
+# Org-wide secret scan using TruffleHog's built-in GitHub source.
+# See: https://github.com/trufflesecurity/trufflehog — `trufflehog github --org=…`
+#
+# Test now: Actions → this workflow → Run workflow.
+# Smoke test: set `single_repo` to one HTTPS URL and leave org as default.
+
+name: TruffleHog org scan (GitHub)
+
+on:
+  workflow_dispatch:
+    inputs:
+      org:
+        description: "GitHub org slug (used when single_repo is empty)"
+        required: true
+        default: "grafana"
+        type: string
+      single_repo:
+        description: "Optional smoke test: one repo URL, e.g. https://github.com/grafana/grafana"
+        required: false
+        default: ""
+        type: string
+  schedule:
+    # Weekly; delete this block if you only want manual runs.
+    - cron: "15 4 * * 0"
+
+permissions:
+  contents: read
+  actions: write
+
+env:
+  # renovate: datasource=github-releases depName=trufflesecurity/trufflehog
+  TRUFFLEHOG_VERSION: v3.94.0
+  DEFAULT_ORG: grafana
+
+jobs:
+  scan:
+    name: Scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 360
+    steps:
+      - name: Install TruffleHog
+        run: |
+          if [[ "$(uname -m)" == "aarch64" ]]; then
+            ARCH="linux_arm64"
+          else
+            ARCH="linux_amd64"
+          fi
+          BINARY_URL="https://github.com/trufflesecurity/trufflehog/releases/download/${TRUFFLEHOG_VERSION}/trufflehog_${TRUFFLEHOG_VERSION#v}_${ARCH}.tar.gz"
+          curl -sSfL "${BINARY_URL}" | tar -xz -C /tmp
+          sudo mv /tmp/trufflehog /usr/local/bin/trufflehog
+          sudo chmod +x /usr/local/bin/trufflehog
+          trufflehog --version
+
+      - name: Run scan (advisory — never blocks merges)
+        env:
+          TOKEN: ${{ secrets.ORG_TRUFFLEHOG_PAT }}
+        run: |
+          if [[ -z "${TOKEN}" ]]; then
+            echo "::error::Create repository secret ORG_TRUFFLEHOG_PAT (PAT with read access to the org repos you scan)."
+            exit 1
+          fi
+
+          ORG="${DEFAULT_ORG}"
+          SINGLE_REPO=""
+          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
+            ORG="${{ github.event.inputs.org }}"
+            SINGLE_REPO="${{ github.event.inputs.single_repo }}"
+          fi
+
+          set +e
+          if [[ -n "${SINGLE_REPO}" ]]; then
+            echo "Mode: single repo → ${SINGLE_REPO}"
+            trufflehog github \
+              --repo="${SINGLE_REPO}" \
+              --token="${TOKEN}" \
+              --json \
+              --no-update \
+              --results=verified,unverified \
+              > results.ndjson
+          else
+            echo "Mode: full org → ${ORG}"
+            trufflehog github \
+              --org="${ORG}" \
+              --token="${TOKEN}" \
+              --json \
+              --no-update \
+              --results=verified,unverified \
+              > results.ndjson
+          fi
+          TH_EXIT=$?
+          set -e
+
+          grep -E '^\{' results.ndjson > filtered.ndjson 2>/dev/null || true
+          if [[ -s filtered.ndjson ]]; then
+            jq -R 'fromjson?' filtered.ndjson | jq -s '.' > results.json
+          else
+            echo "[]" > results.json
+          fi
+
+          VERIFIED="$(jq '[.[] | select(.Verified == true)] | length' results.json)"
+          UNVERIFIED="$(jq '[.[] | select(.Verified == false)] | length' results.json)"
+          TOTAL=$((VERIFIED + UNVERIFIED))
+
+          {
+            echo "### TruffleHog (github source)"
+            echo "- TruffleHog exit: \`${TH_EXIT}\` (non-zero can mean findings or scan errors; artifacts still uploaded)"
+            echo "- Verified: \`${VERIFIED}\`"
+            echo "- Unverified: \`${UNVERIFIED}\`"
+            echo "- Total: \`${TOTAL}\`"
+          } >> "${GITHUB_STEP_SUMMARY}"
+
+          exit 0
+
+      - name: Upload results
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        if: always()
+        with:
+          name: trufflehog_github_${{ github.run_id }}
+          path: |
+            results.json
+            results.ndjson
+          if-no-files-found: warn
+          retention-days: 14

docs/trufflehog-org-fullscan.md

@@ -0,0 +1,25 @@
+# TruffleHog org scan (GitHub source)
+
+Uses the official CLI: [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) — `trufflehog github --org=…` / `--repo=…`.
+
+Workflow: `.github/workflows/org-trufflehog-fullscan.yml`
+
+## Test on GitHub Actions
+
+1. Add secret **`ORG_TRUFFLEHOG_PAT`** (read access to repos you scan).
+2. **Actions** → **TruffleHog org scan (GitHub)** → **Run workflow**.
+3. **Quick test:** set **single_repo** to e.g. `https://github.com/trufflesecurity/test_keys` (public canary) or any repo URL you may read.
+4. Download artifact **`trufflehog_github_<run_id>`** → `results.json` / `results.ndjson`.
+
+## Test locally (same behavior)
+
+```bash
+trufflehog github --repo=https://github.com/trufflesecurity/test_keys --json --no-update --results=verified,unverified
+```
+
+With token: add `--token="$GITHUB_TOKEN"`.
+
+## Notes
+
+- Workflow is advisory (no `--fail`); do not add as a required ruleset check if you want it off the merge path.
+- Weekly schedule is optional; remove `schedule:` in the YAML for manual-only.