From 0960ef07d24205382b8e4067b0576738687f98c2 Mon Sep 17 00:00:00 2001
From: Vishal Karmalkar <vishal.karmalkar@thoughtworks.com>
Date: Wed, 26 Aug 2026 17:45:45 +0530
Subject: [PATCH 1/2] BAH-5025 | Add TruffleHog secret scanning to CI

Adds .github/workflows/trufflehog.yml. Runs TruffleHog OSS on pull
requests, pushes to the default branch, and weekly over full history.

Only credentials verified live against the provider's API fail the job
(--results=verified), so vendored test fixtures and .env placeholders are
ignored. Both actions are pinned to commit SHAs and the workflow requests
only contents: read.
---
 .github/workflows/trufflehog.yml | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 .github/workflows/trufflehog.yml

diff --git a/.github/workflows/trufflehog.yml b/.github/workflows/trufflehog.yml
new file mode 100644
index 0000000..4d3a425
--- /dev/null
+++ b/.github/workflows/trufflehog.yml
@@ -0,0 +1,32 @@
+name: TruffleHog Secret Scan
+
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+  schedule:
+    - cron: '41 3 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  trufflehog:
+    runs-on: ubuntu-latest
+    if: github.actor != 'dependabot[bot]'
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+        with:
+          # TruffleHog diffs commit ranges, so the full history must be present.
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Secret scan
+        uses: trufflesecurity/trufflehog@20652fbbdefffcdaa493a5bf57ab2ac6b1db715b  # v3.97.1
+        with:
+          # ghcr.io/trufflesecurity/trufflehog image tag; bump with the action pin above.
+          version: 3.97.1
+          # Only credentials TruffleHog confirmed live against the provider's API
+          # fail the job. Unverified matches (vendored test fixtures, .env
+          # placeholders, strings inside .jar/.zip/.omod archives) are ignored.
+          extra_args: --results=verified

From 5beba9f74f7872fefa665a31cb0382e1b428c7ca Mon Sep 17 00:00:00 2001
From: vishalkarmalkarthoughtworks
 <96288645+vishalkarmalkarthoughtworks@users.noreply.github.com>
Date: Wed, 26 Aug 2026 19:14:56 +0530
Subject: [PATCH 2/2] BAH-5025 | Drop the weekly cron from the TruffleHog
 workflow

GitHub disables a scheduled workflow in a public repo after 60 days with no
repository activity, and the disable applies to the whole workflow, not just
the cron trigger. Bahmni/bahmni-api-test-automation and
Bahmni/openmrs-module-bedmanagement had already lost Semgrep on every PR this
way, and GitHub does not re-enable it when the repo becomes active again.

Scanning on pull_request and on push to the default branch is unchanged, and
workflow_dispatch stays for an on-demand full scan.
---
 .github/workflows/trufflehog.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/trufflehog.yml b/.github/workflows/trufflehog.yml
index 4d3a425..dd0d89a 100644
--- a/.github/workflows/trufflehog.yml
+++ b/.github/workflows/trufflehog.yml
@@ -4,8 +4,6 @@ on:
   pull_request:
   push:
     branches: [main, master]
-  schedule:
-    - cron: '41 3 * * 1'
   workflow_dispatch:
 
 permissions: