UNCLASSIFIED - NO CUI

Skip to content

Dynamically Create Trufflehog Config in Pipeline

Current Behavior

truffleHog currently scans all directories, unless a whitelist is in repo.

Purpose

We should not be scanning the cloned in pipeline code

Plan

Generate a trufflehog config file that excludes the ci_artifacts directory and if a project has a trufflehog config file in repo and the TRUFFLEHOG_CONFIG CI variable exists, the generated config will also include any skip_strings or skip_paths defined.

Acceptance Criteria

trufflehog scans ignore the pipeline code as well as if a config file exists in repo, additionally ignores the defined strings and paths.

Edited by David Freeman