search

trufflesecurity / trufflehog

Find, verify, and analyze leaked credentials
https://trufflesecurity.com
GNU Affero General Public License v3.0
17.34k stars 1.72k forks source link

Trufflehog scan fails when action is in initial commit #3557

Open bobidle opened 2 weeks ago

bobidle commented 2 weeks ago

TruffleHog Version

Running the latest version of TruffleHog via uses: trufflesecurity/trufflehog@main

Trace Output

https://gist.github.com/bobidle/901838a7c777cf91f374db8b51e69938

Expected Behavior

TruffleHog should scan the initial commit..

Actual Behavior

Process completed with exit code 128

Steps to Reproduce

  1. Create an empty repository
  2. Clone the repository locally
  3. Create folder .github/workflows and file .github/workflows/trufflehog.yaml
  4. Add the general usage example to the file https://github.com/trufflesecurity/trufflehog?tab=readme-ov-file#general-usage
  5. git add ... & git commit ... & git push
  6. Check result of GitHub action.

Environment

References

rgmz commented 1 week ago

The error is interesting: commit b9b115394405ca896c845359a03d5012fa5a6c34 exists in the repository but the action is trying to checkout b9b115394405ca896c845359a03d5012fa5a6c34~1.

fatal: ambiguous argument 'b9b115394405ca896c845359a03d5012fa5a6c34~1'
bobidle commented 1 week ago

The error message is from git rev-parse $HEAD~$COMMIT_LENGTH, reducing $COMMIT_LENGTH by one does not help as this excludes one commit from the scan.

It could be fixed by setting BASE="" (see my linked pull request), but it is possible that i miss something else.

bobidle commented 1 week ago

Test repositories and jobs