on:
  push:

name: Secret Leaks

jobs:
  trufflehog:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        fetch-depth: 0
    - name: Secret Scanning
      uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55  # v3.95.9
      with:
        # exclude buggy detectors that cause false positives and are not relevant to our codebase.
        # lob matches `(live|test)_[a-zA-Z0-9_]{35}`, which any pytest name of exactly 35 characters after
        # `test_` satisfies (e.g. `test_reward_func_wrong_number_of_rewards`).
        extra_args: --results=verified,unknown --exclude-detectors=postgres,lob
