Skip to content

Commit 0a581d5

Browse files
Switch TruffleHog to monitoring mode (non-blocking)
- Set fail-on-verified to false - won't block PRs on verified secrets - Set fail-on-unverified to false - won't block PRs on unverified secrets - Workflow will still scan and post PR comments for visibility - Allows gradual rollout and monitoring before enforcing blocking mode - Can be switched back to blocking mode later by changing to true
1 parent e1e3f95 commit 0a581d5

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

.github/workflows/org-required-trufflehog.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,8 @@ jobs:
2020
name: TruffleHog Secret Scan
2121
uses: ./.github/workflows/reusable-trufflehog.yml
2222
with:
23-
# Simplified workflow - only what you need
24-
fail-on-verified: "true" # Always fail on real secrets
25-
fail-on-unverified: "false" # Lenient for org-wide adoption
23+
# Monitoring mode - no blocking, just reporting
24+
fail-on-verified: "false" # Don't block on verified secrets (monitoring only)
25+
fail-on-unverified: "false" # Don't block on unverified secrets
2626
runs-on: ${{ !github.event.repository.private && 'ubuntu-latest' || 'ubuntu-x86-large' }} # Large runner for internal repositories
2727
secrets: inherit

0 commit comments

Comments
 (0)