feat(action): add image input to allow registry mirror overrides

[eightseventhreethree]

Description:

Adds an optional image input to the TruffleHog GitHub Action, defaulting to ghcr.io/trufflesecurity/trufflehog. Users in environments that require a registry mirror can override it without any change to default behavior.

Checklist:

• Lint passing (make lint this requires golangci-lint)?

---

Note

Low Risk
Optional input with the same default image path; only affects which Docker registry is used for the scan container.

Overview
Adds an optional image input to the TruffleHog GitHub Action so workflows can pull the scanner from a registry mirror instead of the default ghcr.io/trufflesecurity/trufflehog. Default behavior is unchanged when image is omitted.

The composite action passes image into the run step and uses "${IMAGE}:${VERSION}" for docker run instead of a hardcoded registry path. README documents the new input alongside the existing version option.

^{Reviewed by Cursor Bugbot for commit eaab27e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

All committers have signed the CLA.

[eightseventhreethree]

Hey, @mustansir14 @kashifkhan0771 @MuneebUllahKhan222 anything else needed here? We have this as a real need.

[gugacyber]

The feature is useful and the default behavior is preserved, but line 102 has a shell injection risk: ${IMAGE} is unquoted in the docker run invocation. If a workflow passes image: "ghcr.io/evil/image --privileged", the extra tokens will be interpreted as additional flags by the shell before docker sees them.
Suggest quoting: "${IMAGE}:${VERSION}" — same fix that should apply to ${VERSION} and ${BASE} on the same line for consistency.

[eightseventhreethree]

Hey, @mustansir14 @kashifkhan0771 @MuneebUllahKhan222 anything else needed here? We have this as a real need.

@kashifkhan0771 who else should I ping to get required approval?

[MuneebUllahKhan222]

Hey, @mustansir14 @kashifkhan0771 @MuneebUllahKhan222 anything else needed here? We have this as a real need.

@kashifkhan0771 who else should I ping to get required approval?

Hi @eightseventhreethree, We just need an approval from product-eng once they approve it we can go ahead with merging this PR.

[camgunz]

Can we apply @gugacyber's suggestion:

Suggest quoting: "${IMAGE}:${VERSION}" — same fix that should apply to ${VERSION} and ${BASE} on the same line for consistency.

[eightseventhreethree]

Can we apply @gugacyber's suggestion:

Suggest quoting: "${IMAGE}:${VERSION}" — same fix that should apply to ${VERSION} and ${BASE} on the same line for consistency.

@camgunz done here

[eightseventhreethree]

@camgunz let me know what else you need from me to get this merged. ty.

[eightseventhreethree]

@camgunz is there someone else I need to reach out to about getting this merged?

[eightseventhreethree]

@shahzadhaider1 Thank you!