From 859646c22e9ee9af83c78bad6c17df2afa979102 Mon Sep 17 00:00:00 2001 From: Aaron Bacchi Date: Tue, 25 Aug 2026 09:07:46 -0400 Subject: [PATCH 1/2] [DEVOPS-10128] Replace TruffleHog with Gitleaks for secret scanning Co-authored-by: Cursor --- .github/workflows/secrets_scan.yml | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/.github/workflows/secrets_scan.yml b/.github/workflows/secrets_scan.yml index c123b0978..c84b6b732 100644 --- a/.github/workflows/secrets_scan.yml +++ b/.github/workflows/secrets_scan.yml @@ -4,14 +4,6 @@ on: pull_request: jobs: - TruffleHog: - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - with: - fetch-depth: 0 - - name: Secret Scanning - uses: trufflesecurity/trufflehog@6c64db94d5b2e09d7e0948fb6bd3166cc6fffbc7 # main - with: - extra_args: --only-verified + gitleaks: + uses: Labelbox/reusable-workflows/.github/workflows/Secret-Scan.yml@main + secrets: inherit From 8e20a7146c364b850be1a9e8812d1f5b5c0e20d2 Mon Sep 17 00:00:00 2001 From: Aaron Bacchi Date: Tue, 25 Aug 2026 11:17:10 -0400 Subject: [PATCH 2/2] [DEVOPS-10128] Remove repository secret-scanning workflow Rely on the existing LLM code-scanning controls instead of maintaining a separate TruffleHog or Gitleaks workflow. --- .github/workflows/secrets_scan.yml | 9 --------- 1 file changed, 9 deletions(-) delete mode 100644 .github/workflows/secrets_scan.yml diff --git a/.github/workflows/secrets_scan.yml b/.github/workflows/secrets_scan.yml deleted file mode 100644 index c84b6b732..000000000 --- a/.github/workflows/secrets_scan.yml +++ /dev/null @@ -1,9 +0,0 @@ -name: Secret_Scan - -on: - pull_request: - -jobs: - gitleaks: - uses: Labelbox/reusable-workflows/.github/workflows/Secret-Scan.yml@main - secrets: inherit