Scanning in CI

5 min

TruffleHog can scan Git based CI tools to prevent secrets from being merged. TruffleHog OSS runs as a standalone CLI binary or Docker image, so it can be added as a scan step in any CI platform. In a typical setup, the scan runs on each push or pull request to detect secrets before they are merged.

This includes:

Jenkins

GitHub Actions

GitLab

Azure Pipelines

Bitbucket Pipelines

CircleCI

Drone CI

Travis CI

GitHub Actions

TruffleHog can be run as a GitHub Action. Please follow the instructions in the open-source project README.

CircleCI

Adjust the --since-commit value to match your default branch that people merge into.

# See: https://circleci.com/docs/2.0/configuration-reference
version: 2.1

jobs:
  scan-secrets:
    docker:
      - image: trufflesecurity/trufflehog:latest
    steps:
      - checkout
      - run:
          name: "Scan for secrets"
          # change --since-commit to match your default branch
          command: trufflehog git file://. --since-commit main --branch "$CIRCLE_BRANCH" --fail --only-verified

workflows:
  scan-secrets:
    jobs:
      - scan-secrets

General usage

You can run TruffleHog using the binary directly, or with Docker.

The first expected argument is the base reference, typically the main branch that you merge into, such as main or master. The second argument is the HEAD reference. If your branch is already checked out, you can simply use HEAD, otherwise give a branch, tag, or commit reference.

TruffleHog will return a non-zero exit code if there are findings.

You can see the all of the available flags for the trufflehog-launcher git command below:

Launching directly

$ trufflehog-launcher git --help
usage: TruffleHog git [<flags>] <base> <head> [<workdir>]

Scans a local git repo.

Flags:
      --help                  Show context-sensitive help (also try --help-long and --help-man).
  -v, --debug                 Enable debug mode.
      --trace                 Enable tracing of code line numbers.
      --json                  Enable JSON output.
      --send-error-telemetry  Turns error telemetry off.
      --fail-verified         Only emit failure code for verified findings.
      --quiet                 Only show results.
      --config=CONFIG         Path to configuration file. You can also specify Google Secrets Manager secrets with
                              'gsm://<project_id>/<secret_name>'.

Args:
  <base>       Start scanning from here (usually main branch).
  <head>       Scan commits until here (usually dev branch).
  [<workdir>]  Optional path to the repo to scan.

Launching with Docker

$ docker run -v "$(pwd):/workdir" -it --rm us-docker.pkg.dev/thog-artifacts/public/scanner:latest git --fail-verified main HEAD /workdir

🐷🔑🐷 TruffleHog. Unearth your secrets. 🐷🔑🐷
version:  dev

WARN[0004] found secret                                  commit=unstaged email=unstaged file=aws redacted=AKIAXYZDQCENUFS46CE4 type=AWS verified=true
INFO[0004] scanned 4 commits                            
WARN[0004] found 1 VERIFIED secrets                     
exit status 1

That's all there is to it!