From 4d2d9dc20fc88c8e65292b9147aef13a18ecc78c Mon Sep 17 00:00:00 2001
From: Jo <me@thevoid.cafe>
Date: Wed, 25 Feb 2026 02:55:08 +0100
Subject: [PATCH] =?UTF-8?q?=F0=9F=91=B7=20Add=20TruffleHog=20scan=20pipeli?=
 =?UTF-8?q?ne?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .tangled/workflows/trufflehog-scan.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 .tangled/workflows/trufflehog-scan.yaml

diff --git a/.tangled/workflows/trufflehog-scan.yaml b/.tangled/workflows/trufflehog-scan.yaml
new file mode 100644
index 0000000..1d3310a
--- /dev/null
+++ b/.tangled/workflows/trufflehog-scan.yaml
@@ -0,0 +1,15 @@
+when:
+  - event: ["push", "manual"]
+    branch: ["stable", "develop", "bugfix/*", "feature/*", "refactor/*"]
+  - event: ["pull_request"]
+    branch: ["stable"]
+
+engine: "nixery"
+
+dependencies:
+  nixpkgs:
+    - trufflehog
+
+steps:
+  - name: "TruffleHog: scan for exposed secrets"
+    command: "trufflehog git --only-verified file://."
-- 
2.51.2