In Github actions, Tufflehog flags the SHA pin of a Cloudflare action as an unverified Cloudflare secret

[nishils]

Please review the Community Note before submitting

TruffleHog Version

latest via the docker registry

Trace Output

Expected Behavior

Do not flag cloudflare actions that are SHA pinned as issues.

Actual Behavior

Found unverified result 🐷🔑❓
Detector Type: CloudflareApiToken
Decoder Type: PLAIN
Raw result: f84a562284fc78278ff90525d9526f9c718361
Commit: <redacted>
Email: <redacted>
File: .github/workflows/test.yml
Line: 29
Repository: <redacted>
Timestamp: 2024-09-03 23:11:59 +0000

Steps to Reproduce

            - name: Publish
              uses: cloudflare/wrangler-action@f84a562284fc78278ff9052435d9526f9c718361

Have a cloudflare action like the above and the SHA pin will get flagged as an unverified Cloudflare secret

Environment

Github CI/Docker

Additional Context

References

• #0000

[rgmz]

IMO this is related to: #1517 (#3302, #1460, #1456 as well).

Need a comprehensive way to filter known false-positives from detectors.