Update TruffleHog workflow for PR scanning

[kazazes]

Important

Update trufflehog.yml to enhance PR scanning by making checkout fork-safe, fetching base commit, and using extra_args for TruffleHog.

• Workflow Changes:
  • Updates trufflehog.yml to make the checkout process fork-safe by using actions/checkout@v4 with persist-credentials: false and fetch-depth: 0.
  • Adds a step to fetch the base commit locally for diffing using git fetch.
  • Modifies TruffleHog execution to use extra_args for flags --fail, --redact, and --results=verified,unknown.

^{This description was created by for 346da7b. You can customize this summary. It will automatically update as commits are pushed.}

[ellipsis-dev]

Important

Looks good to me! 👍

Reviewed everything up to 346da7b in 40 seconds. Click for details.

• Reviewed 46 lines of code in 1 files
• Skipped 0 files when reviewing.
• Skipped posting 4 draft comments. View those below.
• Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.

1. .github/workflows/trufflehog.yml:17

• Draft comment:
  Good fork‐safe checkout: using the repository field with persist-credentials: false is a solid security practice.
• Reason this comment was not posted:
  Confidence changes required: 0% <= threshold 50% None

2. .github/workflows/trufflehog.yml:23

• Draft comment:
  Setting fetch-depth: 0 ensures full history for diff analysis; just verify that performance remains acceptable on very large repositories.
• Reason this comment was not posted:
  Confidence changes required: 33% <= threshold 50% None

3. .github/workflows/trufflehog.yml:28

• Draft comment:
  Explicitly fetching the base commit (refs/heads/__base) is effective; ensure the base commit is always available in the remote.
• Reason this comment was not posted:
  Confidence changes required: 33% <= threshold 50% None

4. .github/workflows/trufflehog.yml:36

• Draft comment:
  Verify that the extra_args '--fail --redact --results=verified,unknown' are fully supported by trufflehog v3.90.5; future updates might require adjustments.
• Reason this comment was not posted:
  Confidence changes required: 33% <= threshold 50% None

Workflow ID: wflow_d6J6FkVwnjtcf3mv

^{You can customize by changing your verbosity settings, reacting with 👍 or 👎, replying to comments, or adding code review rules.}