excluding a file/folder from scanning in github action

[sjgupta19]

trafficstars

Hi, how do I exlcude particular directory from scanning in my github repo? I am using the following trufflehog setup in github actions -

name: TruffleHog Secret Scan uses: trufflesecurity/[email protected] with: path: ./ base: ${{ env.BRANCH }} head: HEAD args: --only-verified

how can I use exclude-path flag in my github workflow?

[sjgupta19]

some help here...

[mac2000]

look at action.yml the action itself just runs docker image and passes whatever you want via extra args, with that in place you may achieve that like so:

- uses: trufflesecurity/trufflehog@main
  with:
    path: public
    base: ${{ github.event.repository.default_branch }}
    head: HEAD
    extra_args: --debug --exclude-paths=/path/to/exclude.txt

where /path/to/exclude.txt should be a file containing new line delimited regular expressions to exclude from checks, aka

exclude.txt

node_modules
.log

to check it locally you may run something like that:

docker run --rm -v "${PWD}:/code" ghcr.io/trufflesecurity/trufflehog:latest git file:///code --since-commit main --branch HEAD --fail --exclude-paths=/code/exclude.txt --debug --no-update

[zricethezav]

@mac2000 is right, you can use extra_args: --exclude-paths=/path/to/exclude.txt exclude paths