fix(ci): drop the leftover trufflehog step — the estate retired it for gitleaks - #32
Conversation
…r gitleaks quality.yml carries a trufflehog step that the estate already decided against. The standards secret-scanner reusable records the ruling in its own header: "Rationale for gitleaks over trufflehog: ... Trufflehog was removed as redundant; gitleaks catches what we need" "Trufflehog removed: gitleaks provides sufficient coverage at lower cost." So this is not a coverage trade-off. It is a straggler from before that decision — usually carrying continue-on-error, so it sits inside a check it cannot fail, duplicating a scanner that was deliberately dropped. Removing it loses nothing. This repo keeps gitleaks-backed scanning, which the sweep re-verified from this checkout before touching anything: repos where trufflehog is the ONLY leak scanner were deliberately excluded and need gitleaks ADDED instead, which is a separate change. Gitleaks is also the stronger scan here. It runs over the whole working tree with --no-git and exits non-zero on a finding, where this step passed base..head — a diff is narrower than the tree. The lockfile entry is removed by indentation-aware traversal rather than a line filter. A line filter deletes the dependency key but leaves its indented children, which YAML then attaches to the PRECEDING dependency. The file still parses; the only symptom is every lockfile-checked gate failing with no explanation. That happened once already in this campaign. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedRemoves the obsolete trufflehog step from quality.yml since the estate has transitioned to gitleaks. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 5 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
|
|
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
1 participant
quality.ymlcarries a trufflehog step that the estate already decided against.The standards secret-scanner reusable records the ruling in its own header:
So this is not a coverage trade-off. It is a straggler from before that decision — usually carrying
continue-on-error: true, so it sits inside a check it cannot fail, duplicating a scanner that was deliberately dropped.Removing it loses nothing
This repo keeps gitleaks-backed scanning, and the sweep re-verified that from this checkout before touching anything. Repos where trufflehog is the only leak scanner were deliberately excluded — 33 of them estate-wide — because they need gitleaks added, which is a different change and must not be disguised as this one.
Gitleaks is also the stronger scan here: it runs over the whole working tree with
--no-gitand exits non-zero on a finding, whereas this step scannedbase..head. A diff is narrower than the tree.Estate coverage, measured
Across 364 repositories with workflows (60 more have none at all):
A note on the lockfile edit
The
actions.lockentry is removed by indentation-aware traversal, not a line filter.A line filter deletes the dependency key but leaves its four indented children, which YAML then attaches to the preceding dependency. The file still parses as valid YAML — the only symptom is every lockfile-checked gate failing
startup_failurewith no explanation. That happened once already in this campaign, on three repos at once, and is why this sweep asserts every remaining dependency still carries its owncommitfield before committing.Found during the 2026-08-05 estate CI/CD census.
🤖 Generated with Claude Code