TruffleHog Scan Test, pull_request

truffleHog_scan_test.yml

name: TruffleHog Scan Test

on:
 pull_request:
   branches:
     - main

jobs:
 trufflehog:
   runs-on: ubuntu-latest

   steps:
   - name: Checkout repository
     uses: actions/checkout@v2

   - name: Set up TruffleHog
     run: |
      docker pull trufflesecurity/trufflehog:latest
   - name: Run TruffleHog
     run: |
        output=$(docker run --rm -v $PWD:/pwd trufflesecurity/trufflehog:latest github --repo https://github.com/${{ github.repository }} --exclude-paths=/pwd/trufflehog-exclude-path.txt)
        echo "::set-output name=trufflehog_output::$(echo "$output" | tr -d '\r')"
   - name: Check TruffleHog output
      run: |
            echo "$trufflehog_output"
            if [[ "$trufflehog_output" == *"Found unverified result 🐷🔑❓"* || "$trufflehog_output" == *"Found verified result 🐷🔑❓"* ]]; then
          
              info=$(echo "$trufflehog_output" | grep -oP '(?<=Commit: ).*')
              issue_body="Secrets encontradas pelo TruffleHog, com as seguintes informações:\n $info"

              curl -L \
                    -X POST \
                    -H "Accept: application/vnd.github+json" \
                    -H "Authorization: Bearer ${{ secrets.PERSONAL_TOKEN }}" \
                    -H "X-GitHub-Api-Version: 2022-11-28" \
                    "https://api.github.com/repos/owner/repo/issues" \
                    -d "{\"title\":\"TruffleHog found a secret\",\"body\":\"$issue_body\",\"labels\":[\"bug\"]}" \
              exit 1
            fi
      env:
            trufflehog_output: ${{ steps.trufflehog.outputs.trufflehog_output }}