Pin trufflehog to SHA

[mendral-app]

Summary

• Pin trufflesecurity/trufflehog action to commit SHA a633174c3b2242aa1b6f8941d2ad6a99e0305964 instead of mutable main branch reference
• Prevents supply chain attacks where a compromised upstream repository could inject malicious code

Why

Using mutable branch references (like @main) for third-party GitHub Actions creates a supply chain vulnerability. An attacker who compromises the upstream repository could push malicious code that would automatically be executed in our workflows.

Pinning to a specific commit SHA ensures:

• Immutability: The exact code version is locked
• Auditability: The specific commit can be reviewed and verified
• Security: Changes require explicit updates with review

Changes

• .github/workflows/secrets.yaml: Changed trufflesecurity/trufflehog@main to trufflesecurity/trufflehog@a633174c3b2242aa1b6f8941d2ad6a99e0305964
• Added comment documenting the pinning for future reference

---

Note

Created by Mendral. Tag @mendral-app with feedback or questions.

• View implementation session
• Addresses this insight