ci(security): stop the secrets gate failing PRs on other branches' commits

[Gregory91G]

Closes #2025.

secrets (diff) fails pull requests on findings they do not introduce. Two independent causes, one commit each.

The scan reaches unmerged branches. --since-commit prunes only what the base commit can reach, and fetch-depth: 0 puts every branch in the checkout, so TruffleHog walks their commits too. A pull request touching five markdown files (#2289) was scanned over 203 chunks / 258 339 bytes and failed on a commit from an unrelated branch, feat/bamboohr-cdk-fetch-all. --branch "$HEAD_SHA" confines the walk to the merge ref; the same scan then reads 9 chunks / 1 898 bytes.

The Lob detector matches test function names. A Lob key is test_ followed by 35 characters. test_a_deprecated_field_is_not_requested is exactly that shape, and Lob's sandbox accepts any test_-prefixed key, so the finding arrives as verified: true with environment: test. 33 names across 27 files match the pattern today, and each one fails the gate on the pull request that adds it. Lob is a direct-mail API and is not a dependency here, so the detector can only produce false positives. Dropped in all three jobs.

Reviewer note: the two halves are separable. Drop the second commit if you would rather keep the detector and annotate individual lines with trufflehog:ignore — that costs 33 annotations today and one per future long test name.

Test plan

• Failure reproduced locally against run 31097123275's merge ref, same image and arguments: 203 chunks / 258 339 bytes / 2 verified — identical to attempt 3 in CI
• --branch alone, detached HEAD as in CI: 9 chunks / 1 898 bytes, 0 findings
• --exclude-detectors lob alone: 0 findings, scan volume unchanged
• Positive control: scanning the branch that does carry the match, with --branch and without the Lob exclusion, still reports both findings — confining the range does not blind the gate
• actionlint .github/workflows/trufflehog.yml — exit 0
• secrets (diff) passes on this pull request
• The next nightly secrets (full history) reports without the Lob rows

The last two need CI runs and are unchecked until they exist.

Summary by CodeRabbit

• Bug Fixes
  • Improved pull-request security scans to focus on the relevant branch and avoid unrelated history.
  • Excluded a detector that could incorrectly flag repository test names, reducing false positives.

[coderabbitai]

📝 Walkthrough

Walkthrough

The TruffleHog workflow now scopes pull-request scans to the merge ref and excludes the Lob detector from pull-request, full-history, and GitHub API scans. The workflow documents the detector exclusion.

Changes

TruffleHog scan scope

Layer / File(s)	Summary
Pull-request scan scoping .github/workflows/trufflehog.yml	The workflow captures the merge ref HEAD_SHA, limits the pull-request scan to that branch, and excludes the Lob detector.
Detector exclusion documentation and coverage .github/workflows/trufflehog.yml	The workflow documents the Lob detector exclusion and applies it to full-history and GitHub API scans.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• constructorfabric/insight#2002: Directly modifies the same TruffleHog workflow and scan exclusions.
• constructorfabric/insight#2022: Modifies the same workflow’s pull-request scanning behavior and documentation.

Suggested reviewers: cyberantonz

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The workflow restricts scans to HEAD_SHA and excludes the Lob detector, addressing the linked issue's false positives and unrelated-commit failures [#2025].
Out of Scope Changes check	✅ Passed	All changes are limited to the TruffleHog workflow and directly support the linked issue objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the primary change: preventing the secrets gate from scanning commits on unrelated branches.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/trufflehog-scan-range

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/trufflehog.yml:
- Line 160: Update the full-history TruffleHog baseline associated with the scan
configuration containing the lob detector exclusion: rerun the post-change
full-history scan, replace BASELINE with the resulting non-Lob finding count,
and refresh the documented true-positive/false-positive breakdown and triage
date.
- Around line 48-56: Update the TruffleHog invocation in the workflow run block
to scan an explicit Git revision range from SINCE to HEAD_SHA, including the
corresponding invocation around lines 66-67. Preserve the existing merge-commit
and base fallback setup, and ensure the range prevents traversal beyond the
intended PR revisions.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 861482ed-27ff-4939-9ab3-f35b4f57ab75

📥 Commits

Reviewing files that changed from the base of the PR and between 775fd7b and b3ea008.

📒 Files selected for processing (1)

• .github/workflows/trufflehog.yml

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

repo="$(mktemp -d)"
trap 'rm -rf "$repo"' EXIT

git -C "$repo" init -q
git -C "$repo" config user.name review
git -C "$repo" config user.email review@example.invalid

commit() {
  git -C "$repo" add -A
  GIT_AUTHOR_DATE="$1" GIT_COMMITTER_DATE="$1" \
    git -C "$repo" commit -q -m "$2"
}

echo root > "$repo/root"
commit "2026-01-01T00:00:00Z" root
git -C "$repo" branch -M main

git -C "$repo" checkout -q -b pr
echo pr > "$repo/pr.txt"
commit "2026-01-02T00:00:00Z" pr

git -C "$repo" checkout -q main
echo base > "$repo/base.txt"
commit "2026-08-06T00:00:00Z" base

GIT_AUTHOR_DATE="2026-08-06T00:00:01Z" \
GIT_COMMITTER_DATE="2026-08-06T00:00:01Z" \
  git -C "$repo" merge --no-ff --no-edit pr >/dev/null

merge="$(git -C "$repo" rev-parse HEAD)"
base="$(git -C "$repo" rev-parse HEAD^1)"
pr="$(git -C "$repo" rev-parse HEAD^2)"

mapfile -t order < <(git -C "$repo" log --full-history --format=%H "$merge")

pos() {
  for i in "${!order[@]}"; do
    [[ "${order[$i]}" == "$1" ]] && { echo "$i"; return; }
  done
  echo -1
}

base_pos="$(pos "$base")"
pr_pos="$(pos "$pr")"

if (( base_pos >= 0 && pr_pos >= 0 && base_pos < pr_pos )); then
  echo "Reproduced: the base commit appears before the PR commit."
  exit 1
fi

echo "The ordering case was not reproduced; verify with the pinned TruffleHog image."

Repository: constructorfabric/insight

Length of output: 285

---

Use an explicit Git revision range for the PR scan.

HEAD_SHA is the synthetic merge commit. TruffleHog passes the branch value to git log --full-history and stops when it reaches the base hash. If the base tip is newer than an older PR commit, the base commit can appear before that PR commit and the scan can miss it. Pass an explicit range such as ${SINCE}..${HEAD_SHA}, or verify an equivalent pinned-version configuration. Also applies to lines 66-67.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/trufflehog.yml around lines 48 - 56, Update the TruffleHog
invocation in the workflow run block to scan an explicit Git revision range from
SINCE to HEAD_SHA, including the corresponding invocation around lines 66-67.
Preserve the existing merge-commit and base fallback setup, and ensure the range
prevents traversal beyond the intended PR revisions.